Arbitrary Shortcode Execution in WooCommerce Food Plugin for WordPress
CVE-2024-13792
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 February 2025
What is CVE-2024-13792?
The WooCommerce Food - Restaurant Menu & Food Ordering plugin for WordPress suffers from a significant security vulnerability that permits arbitrary shortcode execution. This flaw exists in all versions up to and including 3.3.2, stemming from improper validation during the execution of user-defined shortcodes through the do_shortcode function. As a result, unauthenticated attackers can exploit this weakness to run arbitrary code on the affected system, posing a major risk to users and site integrity.
Affected Version(s)
WooCommerce Food - Restaurant Menu & Food ordering * <= 3.3.2