Ocean Extra WordPress Plugin Unauthenticated Arbitrary Shortcode Execution Vulnerability

A vulnerability allowing unauthenticated arbitrary shortcode execution has been identified in the Ocean Extra plugin for WordPress, affecting all versions through 2.4.6. The issue arises because the plugin does not properly validate values before executing shortcodes, allowing attackers to exploit this flaw, particularly when WooCommerce is installed and active.

Impact

Exploitation of this vulnerability allows for arbitrary shortcode execution, which could lead to various impacts depending on the executed shortcode. In this case, it could be exploited to manipulate WooCommerce cart functionalities.

Remediation

Users are advised to update the Ocean Extra plugin to version 2.4.7 or later.