CVE-2024-10261 is a code injection vulnerability in the cozmoslabs Paid Membership Subscriptions WordPress plugin (up to version 2.13.0). It arises because the plugin fails to properly validate input before executing do_shortcode, allowing unauthenticated attackers to run arbitrary shortcodes. This vulnerability can be exploited remotely without authentication or user interaction, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 7.3 reflects the high severity of this issue. No patch or official fix has been documented yet, and no known active exploitation has been reported.

Successful exploitation allows unauthenticated attackers to execute arbitrary shortcodes within the WordPress environment, which can lead to unauthorized code execution affecting confidentiality, integrity, and availability of the system. This could result in data exposure, modification, or disruption of service depending on the shortcode executed.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin's shortcode execution features or disabling the plugin if feasible. Monitor official cozmoslabs communications for updates and apply patches promptly once released.