CVE-2024-8479 HIGH

CVE-2024-8479: Simple Spoiler 1.2 - 1.3 - Unauthenticated Arbitrary Shortcode Execution

Vendor Webliberty
Product Simple Spoiler
Weakness CWE-94 · Code injection
Published September 14, 2024
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

7.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

The The Simple Spoiler plugin for WordPress is vulnerable to arbitrary shortcode execution in versions 1.2 to 1.3. This is due to the plugin adding the filter add_filter('comment_text', 'do_shortcode'); which will run all shortcodes in comments. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Key dates

02Disclosure timeline

September 14, 2024 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-1977 isaacwasserman mcp-vegalite-server visualize_data eval code injection CVE-2025-59823 Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning CVE-2026-44887 Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path) CVE-2025-11093 Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) CVE-2026-3584 Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process