CVE-2024-13557: WordPress Shortcodes Plugin RCE Vulnerability

CVE-2024-13557 Overview

CVE-2024-13557 affects the Shortcodes by United Themes plugin for WordPress. The plugin fails to validate a value before passing it to the do_shortcode function. Unauthenticated attackers can trigger arbitrary shortcode execution through the vulnerable action. The flaw is present in all versions up to and including 5.1.6. The vulnerability is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Unauthenticated attackers can execute arbitrary WordPress shortcodes, potentially exposing sensitive data or invoking site functionality intended for privileged users.

Affected Products

United Themes Shortcodes plugin for WordPress
All plugin versions through 5.1.6
WordPress sites using themes bundled with this plugin

Discovery Timeline

2025-03-29 - CVE-2024-13557 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13557

Vulnerability Analysis

The Shortcodes by United Themes plugin exposes an action handler that invokes do_shortcode on attacker-controlled input. WordPress do_shortcode parses a string and executes any registered shortcode contained within it. Because the plugin does not validate or restrict the input before invocation, an unauthenticated request can cause the server to execute arbitrary shortcodes registered on the site.

The practical impact depends on which shortcodes are registered on the target site. Attackers can enumerate installed plugins and themes to identify shortcodes that reveal user data, render restricted content, dispatch emails, or trigger internal actions. See the Wordfence Vulnerability Report for advisory context.

Root Cause

The root cause is missing input validation before a dynamic code-generation sink. The plugin trusts a request-supplied value and forwards it directly to do_shortcode. There is no authentication check, capability check, or allowlist of permitted shortcodes on the vulnerable code path. This matches the [CWE-94] pattern of improper control over generated code.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker sends a crafted HTTP request to the WordPress site targeting the plugin's action endpoint. The request payload contains a shortcode string such as [some_shortcode attr="value"]. The server parses and executes the shortcode, returning or acting on the rendered output. No exploit code is publicly available for CVE-2024-13557 at this time.

Detection Methods for CVE-2024-13557

Indicators of Compromise

Unauthenticated POST or GET requests to WordPress admin-ajax.php or plugin action endpoints containing raw shortcode syntax such as [ and ] characters in parameter values.
Web server access logs showing repeated requests from a single source that reference the Shortcodes by United Themes plugin action name.
Unexpected outbound email, form submissions, or database queries generated by shortcode handlers registered on the site.

Detection Strategies

Inspect WordPress request logs for parameters that contain shortcode delimiters submitted by unauthenticated sessions.
Enable WordPress debug logging and correlate do_shortcode invocations with the source IP and request path.
Deploy a Web Application Firewall (WAF) rule that flags shortcode syntax in POST bodies to unauthenticated AJAX handlers.

Monitoring Recommendations

Monitor for anomalous access patterns to the plugin's registered action, particularly high-volume enumeration attempts.
Alert on new outbound network connections or email dispatches initiated by the PHP worker after suspicious plugin requests.
Track file integrity on wp-content/plugins/ to detect follow-on tampering after successful shortcode abuse.

How to Mitigate CVE-2024-13557

Immediate Actions Required

Identify all WordPress installations running the Shortcodes by United Themes plugin at version 5.1.6 or earlier.
Disable the plugin from wp-admin/plugins.php until a patched release is confirmed and installed.
Restrict access to admin-ajax.php from untrusted sources at the WAF or reverse proxy layer.

Patch Information

No fixed version is listed in the current NVD record for CVE-2024-13557. Administrators should consult the United Themes Homepage and the Wordfence Vulnerability Report for updates on a patched release. Apply the vendor patch as soon as it becomes available.

Workarounds

Deactivate the plugin until an official patched version is released by United Themes.
Add WAF rules blocking unauthenticated requests that contain shortcode delimiters in parameter values.
Audit registered shortcodes on the site and remove or restrict any that expose sensitive data or trigger state changes.

bash

# Example WAF rule concept: block shortcode syntax in unauthenticated POSTs
# (adapt to your WAF's syntax before deploying)
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1013557,msg:'Blocked possible CVE-2024-13557 shortcode payload'"
SecRule ARGS "@rx \[[a-z0-9_\-]+(\s|\])" \
  "chain,t:none,t:lowercase"
SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"