WP-Recall WordPress Plugin Shortcode Execution Vulnerability

A vulnerability allowing arbitrary shortcode execution has been identified in the WP-Recall – Registration, Profile, Commerce & More plugin for WordPress, in versions through 16.26.10. This issue arises from a missing capability check on the 'rcl_preview_post' AJAX endpoint, which allows authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes.

Impact

Exploitation of this vulnerability allows for arbitrary shortcode execution, which could be used to execute potentially harmful actions or code on behalf of the user.

Remediation

Users are advised to update the WP-Recall plugin to version 16.26.12 or a newer patched version.