The Ocean Extra plugin contains a flaw that permits unauthenticated users to execute arbitrary shortcodes. The flaw arises because the plugin calls a function that runs user‑supplied data through do_shortcode without properly validating the value. Because shortcodes can run PHP functions, this defect enables an attacker to run arbitrary code on the host.

All release versions of the Ocean Extra plugin for WordPress up to and including 2.4.6 are affected, and the vulnerability is only exploitable when WooCommerce is also installed and activated.

The vulnerability carries a CVSS score of 6.5, denoting a moderate impact, and an EPSS of 17%, indicating a notable likelihood of exploitation. It is not currently listed in the CISA KEV catalog. Attackers can exploit the lack of input validation by injecting a malicious shortcode string that the platform then executes with the privileges of the WordPress site, potentially leading to full code execution, data exfiltration, or service disruption.