Enable Shortcodes inside Widgets,Comments and Experts <= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution

The impact of CVE-2024-9846 is significant due to its ease of exploitation and the potential for widespread compromise. An attacker can leverage this vulnerability to execute arbitrary PHP code through shortcodes, effectively gaining control over the affected WordPress website. This could involve modifying content, injecting malware, stealing sensitive data (user credentials, database information), or even pivoting to other systems on the network. The lack of authentication required for exploitation further amplifies the risk, making it accessible to a wide range of attackers.

Websites using the Enable Shortcodes inside Widgets,Comments and Experts plugin, particularly those running versions prior to the patch release, are at risk. Shared hosting environments where multiple websites share the same server are especially vulnerable, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r 'do_shortcode' /var/www/html/wp-content/plugins/enable-shortcodes-inside-widgets-comments-and-experts/

• wordpress / composer / npm:

wp plugin list --status=inactive | grep enable-shortcodes

• wordpress / composer / npm:

wp plugin list | grep enable-shortcodes

1. 2024-10-30Disclosure

   disclosure

1. 予約済み2024-10-10
2. 公開日2024-10-30
3. EPSS 更新日2026-04-02

The primary mitigation for CVE-2024-9846 is to upgrade the Enable Shortcodes inside Widgets,Comments and Experts plugin to a patched version as soon as it becomes available. Until a patch is released, consider disabling the plugin entirely to prevent exploitation. As a temporary workaround, restrict shortcode usage within widgets and comments to a predefined whitelist of safe shortcodes. Monitor WordPress logs for suspicious shortcode activity and implement a Web Application Firewall (WAF) with rules to block potentially malicious shortcode injections.