CVE-2024-13806 is a code injection vulnerability in the Authors List WordPress plugin (versions up to 2.0.6) caused by improper validation of user input before executing shortcodes via do_shortcode. This flaw enables unauthenticated attackers to execute arbitrary shortcodes, potentially leading to limited confidentiality and integrity impacts. The vulnerability is identified as CWE-94 and has a CVSS 3.1 base score of 6.5 with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary shortcodes within the WordPress environment, potentially leading to limited disclosure or modification of data. The CVSS score of 6.5 reflects a medium severity impact primarily on confidentiality and integrity. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin's functionality or disabling the Authors List plugin if feasible to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.