The vulnerability identified as CVE-2024-11034 affects the 'Request a Quote for WooCommerce – Get a Quote Button' WordPress plugin by wpbean. It arises from improper control of code generation (CWE-94), specifically allowing unauthenticated users to execute arbitrary shortcodes through the fire_contact_form AJAX action. This occurs because the plugin does not properly validate input before executing do_shortcode, enabling potential code injection. The issue is present in all versions up to and including 1.4. The CVSS 3.1 base score is 7.3, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary shortcodes within the WordPress environment, potentially leading to unauthorized code execution. This can compromise confidentiality, integrity, and availability of the affected site. The CVSS score of 7.3 reflects a high-severity impact with network-level exploitation possible without authentication or user interaction.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to disable or remove the affected plugin if possible or restrict access to the AJAX action if feasible. Monitor official wpbean channels for updates and apply patches promptly once available.