CVE-2026-105322: Magee Shortcodes Mail Relay Vulnerability

CVE-2026-105322 Overview

The Magee Shortcodes WordPress plugin through version 2.1.1 contains an unauthenticated mail relay vulnerability. The plugin fails to restrict the recipient address in several of its unauthenticated contact-form actions. Attackers can abuse these actions to send arbitrary emails to any address through the affected site. This behavior effectively turns vulnerable WordPress installations into open mail relays usable for spam campaigns, phishing distribution, and reputation attacks against the hosting domain. The flaw is tracked under CWE-472: External Control of Assumed-Immutable Web Parameter.

Critical Impact
Unauthenticated attackers can send arbitrary emails from the vulnerable site to any recipient, enabling spam distribution and phishing that appears to originate from the trusted WordPress domain.

Affected Products

Magee Shortcodes WordPress plugin versions up to and including 2.1.1
WordPress sites with the Magee Shortcodes plugin installed and activated
Hosting environments permitting outbound SMTP from the WordPress host

Discovery Timeline

2026-10-07 - CVE-2026-105322 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-105322

Vulnerability Analysis

The vulnerability resides in the unauthenticated contact-form handlers exposed by the Magee Shortcodes plugin. These handlers accept HTTP parameters that control the message recipient without verifying that the recipient matches a server-side allowlist or site-configured destination. Any unauthenticated visitor can submit a crafted request that specifies both the message body and the destination email address. The plugin then dispatches the message using the site's mail transport, inheriting the trust and sender reputation of the hosting domain.

Mail relay vulnerabilities of this type enable large-scale abuse. Attackers can distribute phishing lures that pass SPF and DKIM alignment because the mail originates from the legitimate domain's infrastructure. Downstream mail providers may blocklist the hosting IP or domain, disrupting legitimate business communications.

Root Cause

The root cause is improper handling of client-controlled parameters that the plugin treats as trusted. Specifically, the recipient field is sourced from the HTTP request rather than from server-side configuration. This matches the [CWE-472] pattern, where a web parameter assumed to be immutable is actually modifiable by the client.

Attack Vector

Exploitation requires only network access to the public-facing contact-form endpoints. No authentication, user interaction, or elevated privileges are required. An attacker crafts an HTTP POST request to the affected plugin action, supplying attacker-controlled values for the recipient address, subject, and message body. The plugin accepts the request and transmits the email through the site's configured mail transport.

See the WPScan Vulnerability Report for additional technical details on the vulnerable endpoints.

Detection Methods for CVE-2026-105322

Indicators of Compromise

Unusual spikes in outbound SMTP traffic originating from the WordPress host
Mail server logs showing large volumes of messages with varied recipient domains sent from the site's mailer identity
HTTP access logs with repeated POST requests to Magee Shortcodes contact-form action endpoints from a small set of source IPs
Bounce messages or abuse complaints referencing emails the site operator did not send

Detection Strategies

Correlate web server access logs with mail transport logs to identify requests that produce outbound mail with external recipients
Alert on unauthenticated requests to plugin AJAX or admin-ajax.php actions associated with Magee Shortcodes contact handlers
Monitor for high request-to-email ratios from single source IP addresses targeting form submission endpoints

Monitoring Recommendations

Enable WordPress plugin audit logging to capture all form submission events including recipient addresses
Deploy outbound mail rate limiting and alert on threshold breaches at the mail transport agent
Track domain reputation indicators such as blocklist entries, SPF failure reports, and DMARC aggregate reports

How to Mitigate CVE-2026-105322

Immediate Actions Required

Disable or uninstall the Magee Shortcodes plugin until a patched release is confirmed
Review mail transport logs for the past 30 days to identify abusive outbound traffic
Rotate any domain reputation remediation processes if the site appears on mail blocklists
Restrict outbound SMTP from the WordPress host to known mail relays only

Patch Information

At the time of publication, no vendor-confirmed patched version is referenced in the NVD entry. Consult the WPScan Vulnerability Report for current remediation status and monitor the plugin's WordPress.org listing for an updated release beyond version 2.1.1.

Workarounds

Block external access to the affected contact-form endpoints at the web application firewall layer
Replace Magee Shortcodes contact functionality with a maintained alternative plugin that validates recipients server-side
Enforce CAPTCHA or request signing on all public form endpoints to raise the cost of automated abuse
Configure the WordPress mailer to reject messages where the recipient domain is not on an operator-defined allowlist

bash

# Example Apache rule to block the vulnerable action endpoint
<LocationMatch "/wp-admin/admin-ajax.php">
    SetEnvIfNoCase Request_URI "action=magee_contact" block_magee
    Require all granted
    Require not env block_magee
</LocationMatch>