CVE-2026-3424 Overview
CVE-2026-3424 affects the kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress in all versions up to and including 5.4.10.3. The plugin fails to validate the payload value before passing it to do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes on affected sites. The flaw is classified under CWE-94: Improper Control of Generation of Code.
Critical Impact
Unauthenticated attackers can trigger execution of arbitrary WordPress shortcodes through an AJAX endpoint, potentially exposing data or invoking functionality from other installed plugins.
Affected Products
- WordPress plugin: kk Star Ratings – Rate Post & Collect User Feedbacks
- Versions: all releases up to and including 5.4.10.3
- Fixed in the release corresponding to WordPress plugin changeset #3474555
Discovery Timeline
- 2026-08-22 - CVE-2026-3424 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-3424
Vulnerability Analysis
The vulnerability lives in the plugin's AJAX handler wp_ajax_kk-star-ratings, which is reachable by unauthenticated clients through the wp-admin/admin-ajax.php endpoint. The handler accepts a payload parameter from the request and forwards it to WordPress's do_shortcode function without validating that the string represents an expected shortcode for the rating widget. Because do_shortcode interprets any registered shortcode in the input, an attacker can supply arbitrary shortcode markup and cause the plugin ecosystem installed on the site to execute it in the request context. The affected code paths are documented in the plugin AJAX action source and the main script function.
Root Cause
The root cause is missing input validation on the payload request parameter before shortcode expansion. The plugin trusts client-supplied content and does not restrict do_shortcode to a known-safe subset of tags associated with rating functionality, which is a classic instance of improper control of code generation.
Attack Vector
Exploitation requires no authentication and no user interaction. An attacker sends a crafted HTTP POST request to admin-ajax.php with action=kk-star-ratings and a malicious payload value containing arbitrary shortcode markup. Impact depends on which other shortcode-registering plugins are present on the target site, since those shortcodes become reachable through the vulnerable handler. Refer to the Wordfence vulnerability report for additional context.
Detection Methods for CVE-2026-3424
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php with action=kk-star-ratings and a payload parameter containing shortcode syntax such as [ and ] characters not associated with rating widgets.
- Unexpected outbound HTTP requests or file operations originating from the web server process shortly after admin-ajax.php activity.
- Web server access logs showing unauthenticated requests to the kk-star-ratings AJAX action from a single source at elevated volume.
Detection Strategies
- Inspect access logs for admin-ajax.php traffic with the kk-star-ratings action and decode the payload parameter to look for shortcode names beyond the plugin's own tags.
- Correlate WordPress error logs and PHP execution telemetry with AJAX requests to identify shortcode expansion invoking unrelated plugins.
- Deploy a WAF rule that flags payload values in requests to the vulnerable action when they contain bracket characters or known shortcode identifiers.
Monitoring Recommendations
- Track version fingerprints of the kk Star Ratings plugin across managed WordPress installations and alert on any host still on 5.4.10.3 or earlier.
- Monitor for anomalous responses from admin-ajax.php such as unusually large payloads, embedded HTML, or reflected content from other plugins.
- Enable file integrity monitoring on the WordPress installation to detect any secondary changes following suspicious AJAX activity.
How to Mitigate CVE-2026-3424
Immediate Actions Required
- Upgrade the kk Star Ratings plugin to the version that includes the fix from changeset #3474555, which is any release after 5.4.10.3.
- If patching is not immediately possible, deactivate the plugin until the update is applied.
- Review other installed plugins for shortcodes that expose sensitive data or side effects and disable those not required.
Patch Information
The vendor addressed the issue in the WordPress plugin repository through changeset #3474555. The fix validates the payload value before invoking do_shortcode so that only expected rating-related shortcodes are processed. Site administrators should apply the update through the WordPress plugin manager or by pulling the latest release from the plugin repository.
Workarounds
- Block unauthenticated POST requests to admin-ajax.php with action=kk-star-ratings at the WAF or reverse proxy layer.
- Restrict access to admin-ajax.php from untrusted networks where feasible, or rate-limit the specific action.
- Temporarily unregister the vulnerable AJAX action with a small must-use plugin if operational constraints prevent upgrade or deactivation.
# Example ModSecurity rule to block exploitation attempts
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
"chain,phase:2,deny,status:403,id:1002026342401,\
msg:'CVE-2026-3424 kk Star Ratings payload shortcode injection'"
SecRule ARGS:action "@streq kk-star-ratings" "chain"
SecRule ARGS:payload "@rx \[[^\]]+\]" "t:none,t:urlDecodeUni"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
