CVE-2025-3472

Summary

CVE-2025-3472 is a vulnerability affecting the Ocean Extra plugin for WordPress. This issue allows unauthenticated attackers to execute arbitrary shortcodes when WooCommerce is installed and activated. The vulnerability arises from the Ocean Extra plugin not properly validating values before running the do_shortcode function. As a result, attackers can exploit this weakness to execute malicious code and potentially gain unauthorized access to a WordPress site. Versions up to and including 2.4.6 of the Ocean Extra plugin are affected. Users are advised to update the plugin to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.