The LayoutBoxx plugin for WordPress allows unauthenticated users to run any shortcode without validating the input. The plugin feeds user‑supplied content directly into WordPress’s do_shortcode function, which executes the code within the shortcode. Because shortcodes can invoke arbitrary PHP code or WordPress functions, an attacker can run malicious PHP on the server, leading to a full compromise of confidentiality, integrity, and availability.

All versions of the LayoutBoxx plugin up to and including 0.3.1 are affected. The vendor is LayoutBoxx and the product is the WordPress plugin named LayoutBoxx.

The CVSS score of 7.3 classifies this flaw as high severity, and the EPSS score of 1.35% indicates that exploitation is technically possible but not widespread. The vulnerability is remote and unauthenticated; an attacker only needs to craft a request containing a malicious shortcode and send it to any page that processes shortcodes. Although the flaw has not yet been listed in the CISA KEV catalog, it presents a significant risk of remote code execution on any live WordPress site that has the plugin enabled.