PT-2025-13608 · WordPress · So-Called Air Quotes

Avraham Shemesh · Published 2025-03-29 · Updated 2025-04-03 · CVE-2025-2803

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions So-Called Air Quotes plugin for WordPress versions up to, and including, 0.1

Description The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software not properly validating a value before running do shortcode(). This enables the execution of an action that can lead to arbitrary shortcode execution.

Recommendations For So-Called Air Quotes plugin for WordPress versions up to, and including, 0.1, consider disabling the plugin until a patch is available to prevent arbitrary shortcode execution. Restrict access to the do shortcode() function to minimize the risk of exploitation. Avoid using shortcodes from untrusted sources in the affected plugin until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-2803

Affected Products

So-Called Air Quotes

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-2803 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/83f2ceee-4422-4ed5-adc7-91bc022ae42d?source=cve · Note
• https://t.me/cvenotify/116919 · Telegram Post
• https://twitter.com/vulns_space/status/1905881962813747586 · Twitter Post
• https://t.me/latest_high_impact_cve/2062 · Telegram Post
• https://twitter.com/cracbot/status/1907750015319339332 · Twitter Post
• https://t.me/cvetracker/20263 · Telegram Post
• https://plugins.svn.wordpress.org/so-called-air-quotes/trunk/airquote.php · Note
• https://twitter.com/VulmonFeeds/status/1905889566537466204 · Twitter Post
• https://t.me/cvedetector/21505 · Telegram Post
• https://twitter.com/CVEnew/status/1906038432373289220 · Twitter Post
• https://wordpress.org/plugins/so-called-air-quotes/#developers · Note