CVE-2024-7381 is a missing authorization vulnerability in the Geo Controller WordPress plugin by creativform. The ajax__shortcode_cache function lacks proper authorization and capability checks, allowing unauthenticated attackers to execute arbitrary shortcodes on the target site. This affects all plugin versions up to and including 8.6.9. The vulnerability is categorized under CWE-862 and has a CVSS 3.1 base score of 5.3 (medium severity). No patches or vendor advisories indicating fixes are currently available, and no known exploits have been reported.

An unauthenticated attacker can execute arbitrary shortcodes on a vulnerable WordPress site using the Geo Controller plugin. This could lead to limited impact such as information disclosure or minor site manipulation depending on the shortcodes available. The CVSS vector indicates no impact on integrity or availability, only a low impact on confidentiality. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently available, users should monitor for updates from creativform. As a temporary mitigation, restricting access to the ajax__shortcode_cache endpoint or disabling the Geo Controller plugin until a fix is released may reduce risk.