CVE-2024-13797 is a high severity (CVSS 7.3) arbitrary shortcode execution flaw in the PressMart Elementor WooCommerce theme for WordPress, in versions up to and including 1.2.16. Unauthenticated attackers can run shortcodes. Update past 1.2.16. The theme is sold through a marketplace, so update from there.
What's affected
- PressMart, Modern Elementor WooCommerce WordPress Theme, all versions up to and including 1.2.16.
The record does not name a fixed version. This theme is sold through a marketplace, so check the item page and changelog for a release newer than the last affected version.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp theme list --format=table | grep -i pressmart
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Update the theme to a release newer than 1.2.16.
- Update child themes if they copy parent theme files.
- Remove unused shortcode providers.
- Look up CVE-2024-13797 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The record says an action does not properly validate a value before running do_shortcode, the same wording used for other themes and plugins this year. The attacker needs no account and no interaction, and the CVSS impact is low in each area.
Theme updates are easy to skip because a theme change feels risky for the live design. Use a staging copy to test the new version first, then update production.
This CVE is an arbitrary shortcode execution flaw (CWE-94, Code Injection). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
WordPress shortcodes are small tags that expand into code-driven content. Running do_shortcode on a value that a visitor supplied means the visitor decides which shortcode runs, from every shortcode registered on the site.
The real impact depends on what is installed. Some shortcodes only print text. Others read data, query the database or change state. The weakness is classed as code injection because the input steers which code executes. The right fix is to validate the value against a fixed list before it reaches do_shortcode, and to avoid exposing the action to unauthenticated users at all.
Quick check
Why test on staging?
Theme updates can change layout. Staging lets you check before production.
Is it only an Elementor problem?
The record names the theme only.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
