CVE-2025-8905 is a code injection vulnerability (CWE-94) in the Inpersttion For Theme WordPress plugin affecting all versions up to 1.0. The issue arises from insufficient restriction on which functions can be invoked via the theme_section_shortcode() function. This allows authenticated users with Contributor or higher privileges to execute arbitrary code on the server by calling arbitrary functions without user-supplied parameters. The vulnerability has a CVSS 3.1 base score of 6.3, reflecting network attack vector, low attack complexity, and limited privileges required. No patch or remediation guidance is currently provided by the vendor or advisory sources.

Successful exploitation allows authenticated users with Contributor-level access or above to execute arbitrary code on the server, potentially leading to limited confidentiality, integrity, and availability impacts. The attack does not require user interaction and can be performed remotely over the network. However, the attacker must have at least Contributor privileges in WordPress, which limits the scope to authenticated users with some level of trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Monitor for updates from the plugin vendor or WordPress security advisories regarding patches or temporary mitigations.