The Ohio Extra plugin for WordPress allows an attacker to inject arbitrary code through the shortcode feature, which can lead to remote code execution on the host server. This is an example of improper code generation (CWE-94). By embedding malicious PHP in a shortcode that the plugin processes, an attacker can bypass normal authentication controls and execute arbitrary code on the server.

Colabrio’s Ohio Extra plugin, versions up to and including 3.4.7, are vulnerable. All installations that use any version at or below this level are affected. No other products or vendors are listed.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of <1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to be able to inject or manipulate shortcode content on a victim site, likely via an authenticated user role that can edit content or through a public form that accepts shortcode input. Injection of malicious code would result in the server executing that code, giving the attacker control over the affected system.