CVE-2024-9846 is a code injection vulnerability (CWE-94) in the WordPress plugin 'Enable Shortcodes inside Widgets, Comments and Experts' by amu02aftab. The plugin improperly controls the generation of code by failing to validate inputs before executing do_shortcode, enabling unauthenticated attackers to run arbitrary shortcodes. This affects all versions up to and including 1.0.0. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation allows unauthenticated attackers to execute arbitrary shortcodes within the WordPress environment, potentially leading to code execution, data manipulation, or denial of service. The impact includes confidentiality, integrity, and availability losses as indicated by the CVSS vector. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or removing the vulnerable plugin to prevent exploitation.