WordPress Tabs plugin: Remote code execution by editors in versions up to 2.5

Summary

The Tabs Responsive WordPress plugin up to and including version 2.5 contains a flaw (CWE-94, code injection) that allows remote code execution. According to the CVE record, an attacker with an Editor account can run code on the server, which Patchstack describes as able to run any command. The exploit mechanism and affected feature are not verified because the Patchstack advisory could not be retrieved, and the NVD status is Deferred.

Affected

• Tabs Responsive WordPress plugin (wpshopmart), all versions up to and including 2.5
• Required privilege: Editor (PR:H), high complexity (AC:H)

Fixed in

Unknown. No vendor advisory or confirmed fixed version found. Check the live WordPress.org listing and the Patchstack entry.

Workaround

• No vendor-confirmed workaround available.
• Review and reduce accounts with Editor, Shop Manager or higher roles.
• Deactivate and remove the plugin if its features are not needed.
• Restrict WordPress admin access by IP or VPN where practical.

Exploitation

• Known exploited: no (per sources reviewed; CISA KEV not checked directly).
• Public proof of concept: none found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Patchstack rates the priority as medium and expects exploitation.

Our recommendation

• Check whether the plugin is installed on each WordPress site and at which version.
• Remove or deactivate the plugin if not needed, or replace it with a maintained alternative.
• Review Editor and Shop Manager accounts and enforce strong passwords and MFA.
• Re-check the Patchstack advisory and the WordPress.org changelog for a fixed version and update once available.
• Monitor WordPress logs for unusual plugin or code activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack vulnerability entry patchstack.com
• HOL Guard CVE entry hol.org
• OffSeq Radar CVE entry radar.offseq.com
• WordPress.org plugin listing (en-au) en-au.wordpress.org
• WPScan plugin page wpscan.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:32.