The So‑Called Air Quotes WordPress plugin is susceptible to arbitrary shortcode execution in all releases up to version 0.1. The flaw arises because user‑supplied data is not validated before being passed to do_shortcode, allowing an attacker without authentication to execute any shortcode. This constitutes a code‑execution vulnerability (CWE‑94) that can lead to unauthorized data exposure, site defacement, or further compromise if the shortcode runs malicious code.

WordPress sites that have the So‑Called Air Quotes plugin version 0.1 or earlier installed are affected. The vendor is davemacd and the product is So‑Called Air Quotes.

The vulnerability carries a CVSS score of 7.3, indicating a high severity and a high impact on confidentiality and integrity. The EPSS score of 1% suggests that the probability of exploitation is low but not negligible, and it is not currently listed in CISA’s KEV catalog. The available information infers that unauthorized users can trigger the shortcode processing through a crafted HTTP request to the plugin’s shortcode endpoint, which makes the attack vector likely to be remote over the web. No authentication is required, so a widespread exploitation is theoretically possible if the plugin is widely deployed.