The vulnerability in Dynific Addons for Elementor allows an attacker to inject and execute any WordPress shortcode without authentication. By including arbitrary shortcode tags in a comment, the plugin’s unvalidated call to do_shortcode processes the content during page rendering, effectively enabling code execution under the web server’s privileges. This flaw permits a range of attacks such as remote code execution, data exfiltration, or defacement, depending on the shortcodes used.

The defect affects the Dynific Addons for Elementor plugin, built by wpvibes, in all releases up to and including version 1.3.0. Any site deploying this plugin and displaying it through an AE template that incorporates the AE Post Comments widget is susceptible.

The CVSS score of 6.5 indicates a medium severity for the vulnerability. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. The attack requires a publicly‑viewable post that renders the AE template, an active AE Post Comments widget, and a comment that becomes visible—either through a previously approved comment or by loosening comment moderation. Once these conditions are met, an unauthenticated user can trigger arbitrary shortcode execution by submitting a comment containing malicious shortcode tags.