CVE-2026-92235

Summary

The flaw allows authenticated attackers with subscriber-level access or higher to execute arbitrary shortcodes, leading to potential unauthorized actions on the WordPress site.

Exploitability

Exploitation is moderately easy given the attacker needs only subscriber-level access, but the required action is not trivial.

Blast radius

If exploited, this could lead to significant damage, such as data manipulation or site compromise, affecting the entire site.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.4.3 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.