CVE-2025-48119: RS WP Book Showcase RCE Vulnerability

CVE-2025-48119 Overview

CVE-2025-48119 is a code injection vulnerability in the RS WP Book Showcase WordPress plugin developed by RS WP THEMES. The flaw affects all versions up to and including 6.7.59 and stems from improper control of code generation, classified under [CWE-94]. Attackers can exploit the issue over the network without authentication or user interaction to execute arbitrary shortcodes on affected WordPress sites. The vulnerability enables information disclosure by abusing arbitrary shortcode execution to render content the requester should not access.

Critical Impact
Unauthenticated network attackers can trigger arbitrary shortcode execution in the rs-wp-books-showcase plugin, leading to code injection and confidentiality impact on WordPress installations running vulnerable versions.

Affected Products

RS WP Book Showcase (rs-wp-books-showcase) plugin for WordPress
All versions from initial release through 6.7.59
WordPress sites with the plugin installed and activated

Discovery Timeline

2025-05-16 - CVE-2025-48119 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48119

Vulnerability Analysis

The RS WP Book Showcase plugin fails to properly control how user-supplied input is processed when generating and executing WordPress shortcodes. This category of flaw, [CWE-94] Improper Control of Generation of Code, allows an attacker to inject shortcode directives that the plugin then evaluates in the context of the site. The result is arbitrary shortcode execution, where an unauthenticated requester can invoke shortcodes registered by WordPress core, other plugins, or themes on the target site.

Because shortcodes can expose privileged content, form data, and internal identifiers, arbitrary execution translates directly to information disclosure. The advisory published by Patchstack describes this as an arbitrary shortcode execution vulnerability affecting the plugin through version 6.7.59. Exploitation does not require any privileges or user interaction and is performed remotely over the network.

Root Cause

The root cause is the plugin passing untrusted input into do_shortcode() or an equivalent shortcode-processing routine without validating or restricting which shortcode tags may be evaluated. When a WordPress plugin invokes shortcode parsing on attacker-controlled strings, any shortcode registered on the site becomes reachable through the vulnerable endpoint.

Attack Vector

An attacker sends a crafted HTTP request to a plugin endpoint that reflects input into the shortcode parser. The request includes a shortcode tag chosen by the attacker, referencing shortcodes registered by other plugins to disclose stored data, list users, or render restricted content. See the Patchstack advisory for technical details on the affected code path.

// No verified proof-of-concept code has been published.
// See the Patchstack advisory linked above for technical details.

Detection Methods for CVE-2025-48119

Indicators of Compromise

HTTP requests to rs-wp-books-showcase plugin endpoints containing bracketed shortcode syntax such as [ and ] in parameter values
Access log entries showing anonymous POST or GET requests referencing plugin admin-ajax.php actions tied to the book showcase functionality
Unexpected responses rendering content from unrelated plugins (contact forms, user directories, private posts) via the plugin's endpoints

Detection Strategies

Inventory WordPress installations and identify sites running rs-wp-books-showcase at version 6.7.59 or earlier
Inspect web server access logs for requests containing URL-encoded shortcode markers (%5B, %5D) targeting plugin routes
Deploy web application firewall rules that flag shortcode syntax in request parameters destined for the plugin

Monitoring Recommendations

Enable WordPress audit logging to capture unauthenticated requests to plugin endpoints and correlate with response sizes
Alert on outbound content responses that include data from shortcodes not present in the requested page template
Track plugin file integrity and version state across managed WordPress fleets to detect vulnerable installs

How to Mitigate CVE-2025-48119

Immediate Actions Required

Update the RS WP Book Showcase plugin to a version later than 6.7.59 as soon as the vendor publishes a fixed release
Deactivate and remove the plugin on sites where it is not actively used
Review web server logs for prior exploitation attempts referencing shortcode syntax against plugin endpoints

Patch Information

The advisory tracked at Patchstack documents the arbitrary shortcode execution issue and tracks vendor remediation status. Administrators should monitor the plugin's WordPress.org listing for a patched release and apply updates through the WordPress admin dashboard or automated plugin management tooling.

Workarounds

Restrict access to WordPress plugin AJAX endpoints from untrusted networks using a web application firewall
Add WAF signatures that block shortcode delimiters ([shortcode] patterns) in request parameters targeting the plugin
Disable the plugin until an official patch is available if the site does not require book showcase functionality

bash

# Example WordPress CLI command to deactivate the vulnerable plugin
wp plugin deactivate rs-wp-books-showcase
wp plugin status rs-wp-books-showcase