CVE-2025-2809: 
WordPress vulnerability analysis and mitigation

The azurecurve Shortcodes in Comments plugin for WordPress has been identified with vulnerability CVE-2025-2809, discovered and disclosed on April 9, 2025. The vulnerability affects all versions up to and including 2.0.2. The plugin has been temporarily closed since April 9, 2025, pending a full security review (NVD CVE, WordPress Plugin).

The vulnerability is classified as an Improper Control of Generation of Code (Code Injection) vulnerability, identified as CWE-94. It has received a CVSS v3.1 base score of 7.3 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The issue stems from the plugin's failure to properly validate values before executing the do_shortcode function (NVD CVE).

The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes in WordPress installations using the affected plugin. This can lead to potential compromise of confidentiality, integrity, and availability of the affected systems, as indicated by the CVSS scoring metrics (NVD CVE).

The vulnerability is exploitable remotely by unauthenticated attackers, requiring low attack complexity and no user interaction, as indicated by the CVSS vector string. No specific instances of exploitation in the wild have been publicly reported (NVD CVE).

The plugin has been temporarily closed and is not available for download pending a full security review. Users are advised to disable and remove the plugin until a patched version becomes available (WordPress Plugin).