CVE-2024-12415 is a code injection vulnerability in the quantumcloud AI Infographic Maker WordPress plugin. The flaw arises because the plugin improperly validates user input before executing shortcodes via do_shortcode, enabling unauthenticated attackers to run arbitrary shortcode commands. This vulnerability affects all plugin versions up to 4.9.0. The issue is categorized under CWE-94, indicating improper control over code generation. The CVSS score of 6.5 reflects a medium severity with network attack vector, no privileges required, no user interaction, and partial confidentiality and integrity impact. No official patch or fix has been documented at this time.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary shortcodes within the WordPress environment, potentially leading to limited confidentiality and integrity impacts. There is no reported impact on availability. The exploitation could allow attackers to perform unauthorized actions or access data controlled by the plugin's shortcode functionality. No known exploits in the wild have been reported.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the AI Infographic Maker plugin if possible, or restrict access to the plugin's functionality to trusted users only. Monitor official quantumcloud communications for updates and apply patches promptly once available.