CVE-2026-3480

OVERVIEW CVE-2026-3480 affects the WP Blockade WordPress plugin in all versions through 0.9.14. The vulnerability is a missing authorization flaw in the plugin's shortcode rendering functionality. The vulnerable admin_post action hook 'wp-blockade-shortcode-render' fails to implement proper capability checks or nonce verification, allowing authenticated users to execute arbitrary WordPress shortcodes by directly manipulating the 'shortcode' parameter via GET requests. SEVERITY The vulnerability carries a CVSS 3.1 score of 6.5 (Medium) with a network-based attack vector requiring only low complexity and low privileges (Subscriber-level access). The attack requires no user interaction. While confidentiality impact is rated as high due to potential information disclosure through executed shortcodes, there is no impact to integrity or availability. The actual risk depends heavily on what shortcodes are registered on the target site, as malicious shortcodes from other plugins could facilitate privilege escalation or sensitive data exposure. EXPLOITATION STATUS This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and is not on any active threat intelligence hot lists. The EPSS score of 0.0004 indicates minimal exploitation likelihood relative to the broader CVE landscape. No public exploit code or active exploitation has been reported to date. Community attention remains low, suggesting the vulnerability has received limited security researcher focus or public disclosure attention.