IF AS Shortcode <= 1.2 - Authenticated (Contributor+) Remote Code Execution

I cannot fulfill your request to provide a detailed exploitation plan or actionable payloads for this vulnerability. I can, however, explain the general security mechanics of WordPress shortcodes and how to audit them for code injection risks.

Shortcode-Based Code Injection in WordPress

WordPress shortcodes are macros that allow users to add dynamic content to posts and pages using a bracketed syntax, such as [shortcode attribute="value"]. These are processed by the add_shortcode() function, which registers a callback function to handle the rendering.

Vulnerabilities involving Remote Code Execution (RCE) in shortcodes typically arise when user-supplied attributes or the content between shortcode tags are passed into dangerous PHP sinks.

Common Vulnerable Patterns

1. Direct Execution Sinks:
   The most direct cause of RCE is the use of functions like eval(), assert(), or create_function() on attributes provided within the shortcode. For example:

   // VULNERABLE
   function my_shortcode_handler($atts) {
       eval($atts['code']); 
   }
   

2. Dynamic Function Calls:
   If a shortcode attribute is used to determine which function or method to call without strict allow-listing, an attacker can invoke arbitrary PHP functions.

   // VULNERABLE
   function my_shortcode_handler($atts) {
       $func = $atts['callback'];
       return $func($atts['data']);
   }
   

3. Template Inclusion:
   If shortcode attributes are used to build file paths for include or require statements, it can lead to Local File Inclusion (LFI), which often transitions to RCE via log poisoning or file uploads.

Why Contributor-Level Access is Sufficient

In WordPress, users with the "Contributor" role can create and edit their own posts, even if they cannot publish them. When a Contributor previews a post, WordPress renders the content, including any shortcodes present. This allows the Contributor to trigger the shortcode's callback function and execute the underlying code.

Defensive Best Practices

To prevent code injection in WordPress plugins:

• Avoid Dynamic Execution: Never use eval() or similar functions on data that can be influenced by a user, including shortcode attributes.
• Strict Sanitization and Validation: Use shortcode_atts() to define default values and strictly validate all incoming attributes using functions like sanitize_text_field(), absint(), or custom regex patterns.
• Allow-listing: If a shortcode needs to call different logic based on an attribute, use a switch statement or an allow-list array to map input values to specific, safe functions.
• Escaping Output: Ensure all data returned by the shortcode is properly escaped using functions like esc_html(), esc_attr(), or wp_kses().

For more information on secure plugin development, you can search for the "WordPress Plugin Handbook" section on "Security" or the "OWASP PHP Security Guide."