CVE-2025-68897 CRITICAL

CVE-2025-68897: WordPress IF AS Shortcode plugin <= 1.2 - Remote Code Execution (RCE) vulnerability

Vendor Mohammad I. Okfie
Product IF AS Shortcode
Weakness CWE-94 · Code injection
Published December 29, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Mohammad I. Okfie IF AS Shortcode if-as-shortcode allows Code Injection.This issue affects IF AS Shortcode: from n/a through <= 1.2.

Explanation of Vulnerability in Simple Terms

02Summary

IF AS Shortcode versions 1.2 and earlier contain a code injection vulnerability. An attacker with low-level site access can inject and execute arbitrary PHP code, gaining full control over the site. The vulnerability affects all confidentiality, integrity, and availability of the site. Update to a version newer than 1.2 immediately.

What an attacker can do

03Attacker Capabilities

Run arbitrary PHP code on the site with full site privileges.

Potential impact on your site

04Site Impact

Complete site compromise: data theft, malware injection, site defacement, or total takeover.

Conditions required to exploit

05Prerequisites

Attacker needs a low-privilege user account (subscriber or contributor level).

Key dates

06Disclosure timeline

December 29, 2025 CVE published
April 28, 2026 Record updated