CVE-2024-11977 is a code injection vulnerability in the kk Star Ratings – Rate Post & Collect User Feedbacks WordPress plugin. The issue arises because the plugin improperly validates input before executing do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes. Versions up to 5.4.10 are affected. A partial fix was introduced in 5.4.10.1, and a complete fix was implemented in 5.4.10.2. This vulnerability has a CVSS 3.1 score of 7.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to code execution within the WordPress environment. This can compromise confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions up to 5.4.10, with partial mitigation in 5.4.10.1 and full mitigation in 5.4.10.2. No known exploits in the wild have been reported yet.

Upgrade the kk Star Ratings plugin to version 5.4.10.2 or later, where the vulnerability is fully patched. Versions 5.4.10.1 only partially address the issue and should not be considered fully secure. If immediate upgrade is not possible, restrict access to the plugin's functionality to trusted users as a temporary measure. Patch status is confirmed by the vendor's versioning notes; no other official advisory was provided.