The azurecurve Shortcodes in Comments plugin for WordPress allows attackers to execute any shortcode string submitted through a comment. The plugin does not validate the shortcode content before passing it to WordPress’s do_shortcode function, enabling arbitrary shortcode execution whenever the plugin processes comment data. Because this flaw exists in all releases up to and including version 2.0.2, any visitor who can submit a comment can trigger the vulnerable code path and run malicious shortcodes on the site.

WordPress installations that have the azurecurve Shortcodes in Comments plugin installed with a version of 2.0.2 or earlier are affected. No other products or versions are listed as impacted.

The vulnerability scores a CVSS of 7.3, indicating high severity, and an EPSS of < 1%, indicating a very low but nonzero exploitation probability. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is unauthenticated comment submission containing a crafted shortcode string, which is executed server‑side without authentication.