CVE-2024-13815 is a code injection vulnerability (CWE-94) in the Listingo WordPress theme by Themographics. The issue arises because the theme improperly controls the generation of code by allowing execution of arbitrary shortcodes without proper validation. This affects all versions up to and including 3.2.7. An unauthenticated attacker can exploit this flaw to execute arbitrary shortcodes, potentially impacting confidentiality and integrity of the affected system. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact.

Exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary shortcodes within the WordPress environment running the vulnerable Listingo theme. This can lead to partial confidentiality and integrity compromise, such as unauthorized data disclosure or modification. There is no reported impact on system availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting shortcode execution in the theme or applying temporary mitigations recommended by the vendor or security community. Monitoring for updates from Themographics is advised.