CVE-2025-3472: Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution
The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes when WooCommerce is also installed and activated.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3472?
CVE-2025-3472 has a critical severity, as it allows arbitrary shortcode execution due to improper validation.
Which versions of Ocean Extra are affected by CVE-2025-3472?
All versions of Ocean Extra up to and including 2.4.6 are vulnerable to CVE-2025-3472.
How do I fix CVE-2025-3472?
To fix CVE-2025-3472, update the Ocean Extra plugin to the latest version that addresses this vulnerability.
What kind of attack can CVE-2025-3472 facilitate?
CVE-2025-3472 can facilitate arbitrary shortcode execution, potentially allowing an attacker to run malicious code.
Is CVE-2025-3472 specific to Ocean Extra plugin?
Yes, CVE-2025-3472 specifically affects the Ocean Extra plugin for WordPress.