CVE-2025-14539 affects the Shortcode Ajax WordPress plugin by allowing unauthenticated users to execute arbitrary shortcodes because the plugin does not properly validate input before invoking the do_shortcode function. This improper control of code generation (CWE-94) can lead to code injection attacks. The vulnerability impacts all versions up to and including 1.0. The CVSS 3.1 base score is 5.4, with attack vector network, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

An unauthenticated attacker can execute arbitrary shortcodes on a vulnerable WordPress site using the Shortcode Ajax plugin, potentially leading to unauthorized code execution within the context of the site. The impact affects confidentiality and integrity but does not affect availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Shortcode Ajax plugin or restricting access to the vulnerable functionality to trusted users only. Monitor vendor channels for updates regarding patches or official mitigations.