PT-2025-15921 · WordPress · Order Post

Avraham Shemesh · Published 2025-04-10 · Updated 2025-04-10 · CVE-2025-2805

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: ORDER POST plugin for WordPress versions up to, and including, 2.0.2

Description: The ORDER POST plugin for WordPress is vulnerable to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value before running do shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes, potentially leading to remote code execution.

Recommendations: For versions up to, and including, 2.0.2, consider disabling the do shortcode function or restricting access to it until a patch is available. As a temporary workaround, avoid using unvalidated input in the affected plugin to minimize the risk of exploitation.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-2805

Affected Products

Order Post

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-2805 · Security Note
• https://twitter.com/CVEnew/status/1910296107990831601 · Twitter Post
• https://plugins.svn.wordpress.org/order-post/trunk/wp_post_order.php · Note
• https://twitter.com/VulmonFeeds/status/1910254937671454960 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d35ea739-5ee9-4779-87d5-3f13b11229cf?source=cve · Note
• https://t.me/cvenotify/118568 · Telegram Post
• https://t.me/latest_high_impact_cve/2124 · Telegram Post
• https://twitter.com/vulns_space/status/1910233773821612535 · Twitter Post
• https://twitter.com/modat_magnify/status/1910310158753735003 · Twitter Post
• https://wordpress.org/plugins/order-post/#developers · Note