The vulnerability in Administrative Shortcodes allows authenticated users with Contributor-level permissions to supply a crafted ‘slug’ value to the get_template shortcode, which is passed unchecked to WordPress’s get_template_part() function. This lack of path validation lets the attacker include and execute arbitrary files on the server, including potentially user‑generated PHP files, enabling code execution, data theft, or escalation of privileges.

WordPress sites running the Administrative Shortcodes plugin up to and including version 0.3.4 are affected. The plugin is most commonly found on public forums, community sites, or any WordPress installation that has installed Administrative Shortcodes and allows Contributor or higher roles to create or edit content containing shortcodes.

The CVSS score of 7.5 indicates high severity. The EPSS score is less than 1 % and the vulnerability is not listed in the KEV catalog, suggesting low current exploitation probability, though the attack requires an authenticated Contributor or higher. Exploitation would involve uploading a specially crafted file or inserting a malicious ‘slug’ parameter into a page that is rendered with the get_template shortcode. If successful, the attacker could achieve full remote code execution on the site server.