Arbitrary Shortcode Execution in The Authors List Plugin for WordPress
CVE-2024-13806

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Authors List
Vendor
CVE Published:
1 March 2025

What is CVE-2024-13806?

The Authors List plugin for WordPress is susceptible to arbitrary shortcode execution due to insufficient input validation in its processing functions. This vulnerability affects all versions up to and including 2.0.6, allowing unauthenticated users to exploit the plugin by executing arbitrary shortcodes. This failure in validation can lead to unauthorized actions and potential compromise of the WordPress site, raising significant security concerns for users and administrators.

Affected Version(s)

Authors List * <= 2.0.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

abrahack
.