The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.6.0. The flaw allows the plugin to run do_shortcode on user-supplied values without proper validation, enabling an attacker to inject and execute any shortcode, which can lead to remote code execution depending on the shortcode’s payload. The vulnerability is exploitable by unauthenticated users, meaning anyone who can send a request to the site may trigger it.

This issue affects the Ocean Extra plugin provided by oceanwp. Any WordPress installation that has Ocean Extra installed in a version equal to or older than 2.6.0 is impacted. No additional vendors or products are listed as affected.

The CVSS score of 6.5 places the flaw in the moderate severity range. Although the EPSS score is not available and the vulnerability has not been listed in CISA’s KEV catalog, the ability for unauthenticated attackers to trigger the flaw through crafted requests presents a tangible risk. Based on the description, it is inferred that an attacker can send a request containing a malicious shortcode to the site, which will be executed by the plugin without further checks. The lack of authentication requirements lowers the effort needed to exploit this vulnerability, heightening its practical impact in environments with the affected plugin deployed.