CVE-2025-3472 is a medium severity flaw (CVSS 6.5) in the Ocean Extra plugin for WordPress. In versions up to and including 2.4.6, unauthenticated visitors can run arbitrary shortcodes when WooCommerce is also active. Update Ocean Extra to a release newer than 2.4.6 and check the advisory for the exact fixed version.
What's affected
The record says all Ocean Extra versions up to and including 2.4.6 are affected. The issue only applies when WooCommerce is installed and activated on the same site. Sites without WooCommerce are not described as affected by this path.
The record points to a change in the plugin's shortcode file and a Wordfence entry. The record does not state the first fixed version, so confirm it in the Wordfence advisory or the plugin changelog. The current public plugin page lists a much newer release than 2.4.6.
How to check if you're exposed
With WP-CLI you can check the installed version and whether WooCommerce is active:
wp plugin list --name=ocean-extra --fields=name,status,version
wp plugin list --name=woocommerce --fields=name,status,version
In the dashboard, open Plugins and read the version under Ocean Extra. If it is 2.4.6 or lower and WooCommerce is active, treat the site as exposed. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related advisories.
What to do now
- Back up the site files and database.
- Update Ocean Extra to the latest version from the WordPress plugin directory, for example with wp plugin update ocean-extra.
- Confirm the new version is above 2.4.6 and compare it with the fixed version in the Wordfence advisory.
- Turn on automatic plugin updates for plugins you rely on.
- Remove plugins you no longer use, since inactive code still adds to your inventory.
Why it matters
The weakness is CWE-94, improper control of code generation. The record explains that the plugin lets a user trigger an action that does not validate a value before it is passed to the WordPress do_shortcode function. A shortcode is a small tag that WordPress expands into content or behaviour.
An attacker who can pick the shortcode can make the site run features the owner never meant to expose. The impact depends on which shortcodes are installed, which is why the score is medium and not higher. The CVE is not on the CISA Known Exploited Vulnerabilities list and the record does not report exploitation.
Themes and companion plugins often add many shortcodes. Each one is a small piece of code that can be reached through this kind of flaw, so keeping the plugin set small helps.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect sites without WooCommerce?
The record says the unauthenticated exploit path requires WooCommerce to be installed and activated. Update the plugin anyway, since it is the supported fix.
What is the first fixed version?
The record does not say. Check the Wordfence advisory or the plugin changelog.
Sources
- Ocean Extra shortcode source in the WordPress plugin repository
- Wordfence entry for CVE-2025-3472
- Ocean Extra on WordPress.org
Last reviewed: 18 October 2026.
