The Contact Form & SMTP Plugin for WordPress by PirateForms (versions up to 2.6.0) contains a CWE-94 code injection vulnerability (CVE-2024-13453) that permits unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before invoking the WordPress do_shortcode function, enabling arbitrary shortcode execution. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity with network attack vector, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to unauthorized code execution within the WordPress environment. This can compromise confidentiality, integrity, and availability of the affected site. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's functionality where possible and monitor for updates from the vendor. Avoid using affected versions in production environments if feasible.