An attacker can inject PHP code via shortcodes in the Team Showcase plugin, enabling execution of arbitrary code within the WordPress environment. This code‑injection flaw (CWE‑94) can compromise the confidentiality, integrity, and availability of the site, allowing unauthorized data access, defacement, or further exploitation.

The vulnerability affects the cmoreira Team Showcase plugin for all releases before 25.05.13. Users running any version of the plugin prior to this release are at risk, regardless of WordPress core version.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of <1% suggests a low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely exploit the flaw from a remote position by injecting malicious shortcodes into posts or pages; the attack vector is inferred from the plugin’s ability to process arbitrary shortcode content.