CVE-2025-15488: 
WordPress vulnerability analysis and mitigation

CVE-2025-15488 is an unauthenticated arbitrary shortcode execution vulnerability in the Responsive Plus WordPress plugin. It affects all versions before 3.4.3 and was publicly disclosed on March 5, 2026, with the CVE published on March 26, 2026. The flaw allows unauthenticated attackers to execute arbitrary WordPress shortcodes via a misconfigured AJAX action. It carries a CVSS v3.1 base score of 6.5 (Medium) (WPScan).

The vulnerability is classified as CWE-863 (Incorrect Authorization) and stems from the plugin's update_responsive_woo_free_shipping_left_shortcode AJAX action being accessible to unauthenticated users without proper authorization checks. The content_rech_data POST parameter is passed directly to WordPress's shortcode processor without validation, allowing any shortcode registered on the site to be executed. Exploitation requires WooCommerce to be installed and active, along with a free shipping zone configured with a minimum order amount, and at least one product in the store — conditions that are common in real-world WooCommerce deployments (WPScan).

Successful exploitation allows unauthenticated attackers to execute arbitrary WordPress shortcodes, which can lead to unintended content rendering, information disclosure (depending on registered shortcodes), or abuse of shortcodes that trigger sensitive site functionality. The integrity and availability of the site can be affected (CVSS integrity and availability impacts both rated Low), though confidentiality impact is rated None under the base score. The actual severity may be higher in environments where powerful shortcodes (e.g., those executing PHP or interacting with sensitive data) are registered (WPScan).

A public proof-of-concept (PoC) is available via WPScan, demonstrating exploitation using a crafted POST request to /wp-admin/admin-ajax.php with a WooCommerce session cookie. The EPSS score is 0.023% (0.000230), indicating low but non-zero probability of exploitation in the wild. There is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing. The vulnerability was discovered and reported by researcher Alex Tselevich (nos3curity) (WPScan).

1. Pre-requisite setup: Confirm the target WordPress site has the Responsive Plus plugin (version < 3.4.3) installed and active, WooCommerce installed and active, a free shipping zone configured with a minimum order amount, and at least one product available in the store.
2. Obtain a WooCommerce session cookie: As an unauthenticated user, visit the store's /shop/ page and add a product to the cart. Capture the resulting session cookies (e.g., wp_woocommerce_session_*) using a proxy tool such as Burp Suite by intercepting the GET /wp-json/wc/store/v1/cart request.
3. Craft the malicious AJAX request: Prepare a POST request to /wp-admin/admin-ajax.php with the captured cookie header, setting the body parameters: action=update_responsive_woo_free_shipping_left_shortcode and content_rech_data=[shortcode_name]PAYLOAD[/shortcode_name].
4. Execute the shortcode: Send the crafted request. The server processes the content_rech_data value as a WordPress shortcode without authorization checks, returning the rendered output in the HTTP response.
5. Observe results: Confirm shortcode execution by checking the response body for rendered shortcode output (e.g., INJECTED</span> when using [caption]INJECTED[/caption]) (WPScan).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php from unauthenticated or anonymous users containing the parameter action=update_responsive_woo_free_shipping_left_shortcode; presence of shortcode syntax (e.g., [...]) in the content_rech_data POST body parameter.
• Logs: Web server access logs showing repeated POST requests to admin-ajax.php with the above action name from varied or automated IP addresses; WordPress debug logs showing unexpected shortcode execution events.
• Process/Application: Unexpected shortcode output rendered in AJAX responses; unusual WooCommerce session cookie usage patterns from non-browser user agents (WPScan).

The vendor has released version 3.4.3 of the Responsive Plus plugin (responsive-add-ons), which fixes this vulnerability by adding proper authorization checks to the affected AJAX action. Site administrators should update the plugin to version 3.4.3 or later immediately. No official configuration-based workaround has been published; upgrading is the recommended and only confirmed remediation (WPScan).

The vulnerability was discovered and responsibly disclosed by security researcher Alex Tselevich (nos3curity), who also published a write-up on the topic. Coverage has been limited to vulnerability databases and security aggregators, with no major vendor statements or widespread media coverage noted beyond the WPScan advisory and community tracking sites (WPScan, Infinitsec).