CVE-2024-9578 is a missing authorization vulnerability (CWE-862) in the Hide Links WordPress plugin by egolacrima. The plugin improperly hooks the do_shortcode function through the comment_text filter, allowing unauthenticated users to execute arbitrary shortcodes on the site. This affects all versions up to and including 1.4.2. The vulnerability enables unauthorized shortcode execution without requiring privileges or user interaction. The CVSS 3.1 score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact.

An unauthenticated attacker can execute arbitrary shortcodes on a vulnerable WordPress site using the Hide Links plugin, potentially leading to unintended content rendering or information disclosure depending on available shortcodes. The impact is limited to confidentiality as per the CVSS vector, with no integrity or availability impact reported. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or update is currently documented, users should monitor the egolacrima plugin repository or vendor communications for updates addressing this issue. Until a fix is available, consider disabling the Hide Links plugin or restricting comment submissions to trusted users to reduce exposure.