CVE-2024-9581: Shortcodes Anywhere RCE Vulnerability

CVE-2024-9581 Overview

CVE-2024-9581 affects the Shortcodes AnyWhere plugin for WordPress in all versions up to and including 1.0.1. The plugin exposes an action that calls do_shortcode without validating the supplied input. Unauthenticated attackers can send crafted requests over the network to execute arbitrary shortcodes registered on the target site. The vulnerability is classified under CWE-94 Improper Control of Generation of Code (Code Injection). The EPSS probability is 0.847% at the 75th percentile.

Critical Impact
Unauthenticated attackers can execute arbitrary shortcodes registered on the target WordPress site, enabling abuse of any plugin or theme shortcode without credentials or user interaction.

Affected Products

Happyplugins Shortcodes AnyWhere plugin for WordPress, versions * through 1.0.1 (inclusive)
WordPress sites running the plugin with shortcodes that perform sensitive actions
WordPress sites where third-party plugins or themes register shortcodes that expose data or functionality

Discovery Timeline

2024-10-10 - CVE-2024-9581 published to NVD
2024-10-15 - Last updated in NVD database

Technical Details for CVE-2024-9581

Vulnerability Analysis

The Shortcodes AnyWhere plugin registers a handler that accepts a user-supplied value and passes it directly to the WordPress do_shortcode function. Because the handler does not authenticate the caller or sanitize the input, any unauthenticated visitor can trigger shortcode evaluation. WordPress shortcodes are server-side macros that other plugins and themes register to render content, query data, or perform actions. Executing arbitrary shortcodes turns this design feature into an attack primitive.

The impact depends on which shortcodes are registered on the target site. An attacker can invoke shortcodes that expose private content, render administrative widgets, or interact with backend services exposed by other plugins.

Root Cause

The root cause is missing input validation and missing capability checks on the action that invokes do_shortcode. The plugin source in core/shortcodeEverywhere.class.php registers the handler without verifying the request origin, the caller's authentication state, or the structure of the shortcode payload. See the WordPress Plugin Source Code for the affected entry point.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends an HTTP request to the vulnerable WordPress endpoint with a crafted shortcode string. WordPress evaluates the shortcode server-side and returns the rendered output. No authentication cookie, nonce, or referrer check blocks the request.

The vulnerability is described in prose because no public exploit code is currently available. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-9581

Indicators of Compromise

Unauthenticated POST or GET requests to WordPress admin-ajax or plugin endpoints containing shortcode markup such as [shortcode_name ...] in parameter values
Web server access logs showing repeated requests from a single source to plugin-registered actions associated with Shortcodes AnyWhere
Unexpected outbound HTTP requests originating from the WordPress host immediately after inbound requests carrying shortcode payloads
WordPress debug logs containing shortcode rendering errors triggered by malformed bracketed input

Detection Strategies

Inspect HTTP request bodies and query strings for shortcode syntax patterns (\[[a-z0-9_-]+) targeting plugin AJAX actions
Correlate unauthenticated requests to the Shortcodes AnyWhere action with the response body to identify shortcode-rendered content returned to anonymous users
Audit the list of installed shortcodes using global $shortcode_tags and flag those that expose sensitive data if invoked without authentication

Monitoring Recommendations

Enable verbose access logging on wp-admin/admin-ajax.php and any plugin REST routes registered by Shortcodes AnyWhere
Forward WordPress logs to a centralized analytics platform and alert on bracket characters in unauthenticated request parameters
Monitor file integrity on the wp-content/plugins/shortcodes-anywhere/ directory to detect post-exploitation modifications

How to Mitigate CVE-2024-9581

Immediate Actions Required

Deactivate and remove the Shortcodes AnyWhere plugin from any WordPress site running version 1.0.1 or earlier until a patched release is verified
Audit all other installed plugins and themes for shortcodes that perform privileged actions or expose sensitive data
Restrict access to admin-ajax.php for unauthenticated users at the web application firewall layer where feasible

Patch Information

No fixed version has been published in the vendor advisory references at the time of NVD publication. Site operators should monitor the Wordfence Vulnerability Report and the WordPress plugin repository for an updated release that introduces a capability check and input validation around the do_shortcode call.

Workarounds

Remove the plugin entirely if shortcode-anywhere functionality is not business-critical
Add a web application firewall rule that blocks unauthenticated requests containing shortcode bracket syntax to the affected plugin action
Use a server-side mu-plugin to unregister sensitive shortcodes for unauthenticated requests via remove_shortcode on the init hook

bash

# WAF example: block unauthenticated requests containing shortcode markup
# targeting the Shortcodes AnyWhere AJAX action (adapt the action name as needed)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1009581,msg:'CVE-2024-9581 shortcode injection'"
  SecRule ARGS "@rx \[[a-zA-Z0-9_-]+" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in_* "@eq 0"