The flaw is a missing authorization vulnerability in the WP‑Asambleas plugin that allows an attacker to execute arbitrary shortcodes. Exploitation could enable injection of malicious content or potentially remote code execution on a WordPress site, compromising the integrity and confidentiality of site data. The weakness is identified as improper access control (CWE‑862).

All installations of the platcom WP‑Asambleas plugin on WordPress websites that use version 2.85.0 or earlier are affected. Updating the plugin to a newer release that resolves the issue or disabling the plugin removes the vulnerability.

The CVSS score of 4.8 indicates a moderate severity and reflects that the attack requires the ability to supply arbitrary shortcode content, but does not provide full remote code execution. The EPSS score is less than 1%, showing a very low chance of exploitation in current scenarios. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote via the web interface, assuming that the plugin’s access controls are improperly enforced, allowing an attacker to trigger shortcode processing.