CVE-2025-2262 is a missing authorization vulnerability in the samdani Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation WordPress plugin (up to version 3.7.3). The plugin improperly validates input before executing do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes. This can lead to limited confidentiality, integrity, and availability impacts. The vulnerability is remotely exploitable without authentication or user interaction, resulting in a high severity rating (CVSS 7.3). No patch or official fix has been documented yet.

An unauthenticated attacker can execute arbitrary shortcodes via the vulnerable plugin, potentially leading to information disclosure, modification of content, or disruption of service. The CVSS score of 7.3 reflects the high risk due to the network attack vector, no required privileges, and no user interaction. However, the impact is limited to the scope of shortcode execution within the WordPress environment and does not imply full system compromise. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official samdani or WordPress security channels for updates and apply patches promptly once available.