CVE-2024-11733 affects the WordPress Popular Posts plugin by allowing arbitrary shortcode execution due to insufficient validation before invoking do_shortcode. This improper control of code generation (CWE-94) can be exploited by unauthenticated attackers remotely without user interaction or privileges, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected WordPress site. The vulnerability exists in all versions up to 7.1.0. No patch or official fix information is currently available, and no known exploits have been reported.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary shortcodes within the WordPress environment, which can lead to partial loss of confidentiality, integrity, and availability. This may enable attackers to perform unauthorized actions or inject malicious content via shortcode execution. The CVSS score of 7.3 reflects a high severity impact with network-based exploitation and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official sources for updates and apply patches promptly once released.