The Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro plugin for WordPress suffers from a code injection vulnerability (CWE-94) that enables unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before invoking the WordPress do_shortcode function. The vulnerability affects all versions up to 5.3.1. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No official patch or vendor advisory has been provided to confirm remediation status.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary shortcodes within the WordPress environment, potentially leading to unauthorized actions or information disclosure. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the plugin's functionality or disabling it if feasible to reduce exposure. Monitor official channels from the vendor propluginslab for updates and apply patches promptly once released.