Elevated command execution via macro HMAC bypass

Command execution in Notepad++ before 8.9.7 allows local users to run code in an elevated process via macros from attacker-controlled shortcuts.xml. In NppCommands.cpp, the shortcuts.xml integrity check covered UserDefinedCommands but not macro IDs, so macroPlayback executed macro entries without the same HMAC validation that was meant to detect tampering. Exploitation requires a low-privileged local user to influence the settingsDir used by an elevated Notepad++ instance and a user or automation path that triggers the macro; the demonstrated outcomes are protected-file modification and conditional execution of an attacker-controlled .cmd through Open in Default Viewer.