Arbitrary Shortcode Execution in azurecurve Shortcodes in Comments Plugin for WordPress

CVE-2025-2809

What is CVE-2025-2809?

The azurecurve Shortcodes in Comments plugin for WordPress presents a serious security concern due to a flaw that permits arbitrary shortcode execution. This vulnerability arises from inadequate validation during user actions, specifically when executing the do_shortcode function. As a result, unauthenticated attackers can leverage this weakness to execute malicious shortcodes, potentially compromising the site’s integrity and security. It is crucial for users to review their plugin versions and apply necessary updates to safeguard against exploitation.

References