CVE-2024-8478 is a code injection vulnerability in the Affiliate Super Assistent WordPress plugin by worschtebrot. It arises because the plugin permits arbitrary shortcode execution in comments if the 'Parse comments' option is enabled, allowing unauthenticated attackers to inject and execute arbitrary shortcodes. This affects all versions up to and including 1.5.3. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code) and has a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating network exploitable with low attack complexity and no privileges or user interaction required, impacting confidentiality, integrity, and availability at a low level.

Successful exploitation allows unauthenticated attackers to execute arbitrary shortcodes within the WordPress environment, potentially leading to unauthorized code execution. This can compromise the confidentiality, integrity, and availability of the affected system. The impact is rated as high severity based on the CVSS score of 7.3. However, there are no reports of active exploitation in the wild at this time.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory or plugin updates regularly for current remediation guidance. Until a fix is released, it is recommended to disable the 'Parse comments' option in the plugin settings to prevent shortcode execution via comments.