CVE-2025-1509 affects the Show Me The Cookies WordPress plugin by versluis, allowing unauthenticated attackers to execute arbitrary shortcodes via improper validation before the do_shortcode function is called. This code injection vulnerability (CWE-94) exists in all versions up to and including 1.0. The vulnerability enables remote attackers to execute arbitrary code within the context of the WordPress site, potentially impacting confidentiality, integrity, and availability. The CVSS score of 7.3 indicates a high-severity issue exploitable over the network without authentication. No patch or official fix is currently available, and no exploits are known in the wild.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary shortcodes on affected WordPress sites, potentially leading to unauthorized code execution, data disclosure, data modification, or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system. Given the network attack vector and no required privileges, the risk is significant for sites using this plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Show Me The Cookies plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.