The ORDER POST plugin contains a flaw that lets attackers supply unchecked input to the do_shortcode function. This improper validation permits execution of chosen shortcodes without authentication. The vulnerability is identified as a Code Injection weakness (CWE-94). If attackers supply a malicious shortcode that invokes server‑side actions, they can run arbitrary code under the web server’s user privileges, leading to full compromise of the affected WordPress installation.

WordPress sites using the ORDER POST plugin, specifically all releases up to and including version 2.0.2. Any instance that has not applied the recent update remains vulnerable.

The CVSS score of 7.3 signals high severity, and the EPSS value of 1% indicates that a measurable portion of the WordPress ecosystem is likely to attempt exploitation. Although the vulnerability is not yet in the CISA KEV catalog, the ability for unauthenticated actors to trigger arbitrary shortcodes is a clear attacker pathway. The most probable attack vector involves an unauthenticated request to a page that includes a shortcode, or exploitation via the plugin’s existing shortcode processing route.