CVE-2024-10952 is a critical vulnerability identified in the Authors List plugin for WordPress, developed by wpkube. The flaw resides in the update_authors_list_ajax AJAX action, which improperly validates input before executing the WordPress do_shortcode function. This improper control of code generation (CWE-94) allows unauthenticated remote attackers to inject and execute arbitrary shortcodes on vulnerable WordPress sites. Since shortcodes can execute PHP code or trigger other plugin functionalities, this can lead to unauthorized code execution, data leakage, or site defacement. The vulnerability affects all versions up to and including 2.0.4, with no authentication or user interaction required, making it highly exploitable over the network. The CVSS v3.1 base score is 7.3, reflecting high impact on confidentiality, integrity, and availability. No official patches or exploit code are publicly available yet, but the risk remains significant due to the plugin's widespread use and the critical nature of shortcode execution in WordPress environments.

The exploitation of CVE-2024-10952 can lead to unauthorized code execution on affected WordPress sites, potentially allowing attackers to manipulate site content, steal sensitive data, or disrupt service availability. Since the vulnerability requires no authentication, attackers can remotely compromise sites without prior access. This can result in website defacement, injection of malicious content (such as malware or phishing pages), or use of the compromised site as a foothold for further network attacks. The impact extends to the confidentiality of user data, integrity of site content, and availability of the web service. Organizations relying on the Authors List plugin for content management or author attribution face increased risk of reputational damage, data breaches, and operational disruption if exploited.

1. Immediately audit WordPress sites for the presence of the Authors List plugin and identify versions up to 2.0.4. 2. Disable or uninstall the Authors List plugin until an official patch is released. 3. If disabling is not feasible, restrict access to the update_authors_list_ajax AJAX endpoint via web application firewall (WAF) rules or server-level access controls to trusted IPs only. 4. Monitor web server and WordPress logs for suspicious AJAX requests or unusual shortcode execution patterns. 5. Employ security plugins that can detect and block unauthorized shortcode execution. 6. Keep WordPress core and all plugins updated regularly to minimize exposure to known vulnerabilities. 7. Implement least privilege principles for WordPress user roles to limit potential damage from compromised accounts. 8. Prepare incident response plans to quickly address any signs of exploitation. 9. Follow wpkube and WordPress security advisories for timely patch releases and updates.