CVE-2026-10724: Reviews Feed WordPress Plugin RCE Flaw

CVE-2026-10724 Overview

CVE-2026-10724 affects the Reviews Feed WordPress plugin in versions prior to 2.6.5. The plugin fails to neutralize WordPress shortcodes embedded in third-party review content before rendering that content through its dynamic block. Unauthenticated attackers can execute arbitrary shortcodes on any page displaying the feed by planting a shortcode inside a review on the connected source platform. The weakness is classified as insufficient verification of data authenticity [CWE-345]. Exploitation requires an attacker to post crafted review content on the upstream source, then wait for the WordPress site to render that review through the vulnerable dynamic block.

Critical Impact
Unauthenticated attackers can execute arbitrary WordPress shortcodes on public pages by injecting them into third-party review content consumed by the plugin.

Affected Products

Reviews Feed WordPress plugin versions before 2.6.5

Discovery Timeline

2026-07-20 - CVE-2026-10724 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-10724

Vulnerability Analysis

The Reviews Feed plugin ingests review content from connected third-party sources and renders it through a WordPress dynamic block. The rendering path passes review text directly to WordPress shortcode processing without stripping or escaping shortcode syntax. Any [shortcode] markup embedded in a review is interpreted by the WordPress shortcode parser at page render time. Because review sources are external and generally allow public submissions, an attacker can plant shortcode payloads without any authentication on the target WordPress site. The impact depends on which shortcodes are registered on the target site, since the plugin executes any registered shortcode available in the WordPress environment.

Root Cause

The root cause is missing output neutralization of untrusted third-party content [CWE-345]. The plugin treats review data from external sources as trusted and does not call functions such as strip_shortcodes() on review content before rendering. WordPress then processes the embedded shortcodes as if they originated from a privileged author.

Attack Vector

The attack vector is network-based and requires no privileges on the WordPress site. An attacker submits a review containing a WordPress shortcode payload to the connected source platform. When the vulnerable plugin fetches and renders that review through its dynamic block, WordPress executes the shortcode in the context of the page. High attack complexity reflects the need for a shortcode to be registered on the target and for the malicious review to survive moderation on the upstream source.

No verified proof-of-concept code has been published. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-10724

Indicators of Compromise

Review content ingested by the Reviews Feed plugin containing square-bracket shortcode syntax such as [gallery], [embed], or plugin-specific tags
Unexpected HTML, iframes, or media elements appearing on pages that render the Reviews Feed dynamic block
Outbound requests initiated during page rendering that correlate with third-party review ingestion

Detection Strategies

Scan cached and stored review content in the WordPress database for shortcode delimiters within third-party review text
Compare rendered page output against expected review text to identify shortcode expansion
Audit installed plugin versions and flag any Reviews Feed installation below 2.6.5

Monitoring Recommendations

Enable WordPress debug logging and monitor for shortcode execution originating from review feed rendering
Alert on new or modified reviews from connected sources that contain [ and ] character pairs matching shortcode patterns
Review web server access logs for anomalous responses on pages that host the Reviews Feed block

How to Mitigate CVE-2026-10724

Immediate Actions Required

Update the Reviews Feed WordPress plugin to version 2.6.5 or later on all affected sites
Audit existing cached review content and purge entries containing shortcode syntax
Review the list of registered shortcodes on the site and disable any that expose sensitive functionality

Patch Information

The vendor released version 2.6.5 of the Reviews Feed plugin, which neutralizes shortcodes in third-party review content before rendering. See the WPScan Vulnerability Report for advisory details and fixed version confirmation.

Workarounds

Temporarily deactivate the Reviews Feed plugin until the update to 2.6.5 is applied
Remove the Reviews Feed dynamic block from public pages while the plugin is unpatched
Restrict which shortcodes are registered on the site by unregistering non-essential shortcodes via remove_shortcode()

bash

# Update the Reviews Feed plugin via WP-CLI
wp plugin update reviews-feed --version=2.6.5
wp plugin list --name=reviews-feed --fields=name,status,version