CVE-2024-12419 is a code injection vulnerability (CWE-94) in the WOW Styler for CF7 WordPress plugin that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin fails to properly validate input before invoking the do_shortcode function. While version 1.7.0 addressed a related reflected cross-site scripting vulnerability, the arbitrary shortcode execution issue remains unresolved. The vulnerability affects all versions up to and including 1.7.0. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary shortcodes within the WordPress environment, potentially leading to limited confidentiality and integrity impacts such as unauthorized content manipulation or information disclosure. Availability is not impacted. No known active exploits have been reported.

No official patch or fix is currently available for the arbitrary shortcode execution vulnerability. Users should monitor the vendor's advisories for updates. Since the plugin is not a cloud service, remediation depends on vendor patch release or applying custom mitigations such as disabling or restricting the vulnerable functionality. The reflected XSS issue was fixed in version 1.7.0, but the shortcode execution flaw remains. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.