WordPress Plugin Vulnerabilities

RS WP Book Showcase < 6.7.71 - Unauthenticated Arbitrary Shortcode Execution

Description

The plugin is vulnerable to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Affects Plugins

Plugin icon
rs-wp-books-showcase
Fixed in 6.7.71

References

CVE
CVE-2025-48119
URL
https://patchstack.com/database/wordpress/plugin/rs-wp-books-showcase/vulnerability/wordpress-rs-wp-book-showcase-plugin-6-7-40-arbitrary-shortcode-execution-vulnerability

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
theviper17y
Verified
No
WPVDB ID
c6ac629a-e52c-41c2-b560-c1eb521c567e

Timeline

Publicly Published
2025-05-16 (about 1 year ago)
Added
2025-05-20 (about 1 year ago)
Last Updated
2026-09-03 (about 1 month ago)

Other

Published
Title
Published
2024-07-10
Title
WPCS < 1.2.0.4 - Unauthenticated Arbitrary Shortcode Execution
Published
2014-08-01
Title
AREA53 <= 1.0.5 - File Upload Code Execution
Published
2026-04-20
Title
Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE
Published
2019-03-11
Title
WP Live Chat Support Pro < 8.0.0.7 - Unauthenticated RCE
Published
2026-08-19
Title
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass