CVE-2026-85658

Summary

The flaw allows authenticated attackers with subscriber-level access to execute arbitrary shortcodes, potentially leading to remote code execution.

Exploitability

Exploitation is relatively straightforward for attackers with subscriber-level access, as no validation is performed on the shortcode input.

Blast radius

If exploited, the impact could be significant, as it affects all versions up to 4.17.2 and could lead to full site compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 4.17.3 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.