CVE-2024-12415: 
WordPress vulnerability analysis and mitigation

The AI Infographic Maker plugin for WordPress (CVE-2024-12415) contains a vulnerability related to arbitrary shortcode execution affecting all versions up to and including 4.9.0. The vulnerability was discovered by Arkadiusz Hydzik and was publicly disclosed on January 30, 2025 (WPScan).

The vulnerability stems from improper validation of values before executing the do_shortcode function, classified as CWE-94 (Improper Control of Generation of Code). It has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating network accessibility with low attack complexity and no required privileges or user interaction (Wordfence).

The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to unauthorized access to information and system manipulation. The CVSS scoring indicates low-level impacts on both confidentiality and integrity, with no impact on system availability (NVD).

The vulnerability has been fixed in version 5.0.0 of the AI Infographic Maker plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).