CVE-2026-85113 Overview
CVE-2026-85113 affects the GiveWP WordPress plugin in versions prior to 4.16.9. The plugin fails to remove shortcode delimiters from donor-supplied values before rendering them on public pages. Its shortcode stripping logic can be bypassed through nested shortcodes. Unauthenticated attackers can inject arbitrary shortcodes registered on the target site by submitting crafted donor data. The issue is classified as an improper neutralization of special elements weakness [CWE-74].
Critical Impact
Unauthenticated attackers can execute any shortcode registered on the vulnerable WordPress site, potentially exposing sensitive site data or triggering unintended plugin functionality accessible through shortcode handlers.
Affected Products
- GiveWP WordPress plugin versions prior to 4.16.9
- WordPress sites accepting public donations through GiveWP forms
- Any site rendering donor-supplied values on public-facing pages
Discovery Timeline
- 2026-09-21 - CVE-2026-85113 published to NVD
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-85113
Vulnerability Analysis
GiveWP accepts donor-supplied input through public donation forms and stores that input for later display. When the plugin renders these values on public pages, it attempts to sanitize the content by stripping WordPress shortcodes. The sanitizer does not remove shortcode delimiter characters and does not iteratively re-process content after stripping. An attacker who nests one shortcode inside another produces output that still contains a valid shortcode after a single pass. WordPress then executes that shortcode when rendering the page.
The vulnerability allows any unauthenticated visitor to submit crafted donor fields that trigger execution of shortcodes registered by WordPress core, GiveWP itself, or any other installed plugin. The impact depends on which shortcodes exist on the target site. Handlers that expose user data, dump configuration, or perform privileged operations become reachable from an unauthenticated context.
Root Cause
The root cause is incomplete input neutralization [CWE-74]. GiveWP strips known shortcode tokens but leaves the [ and ] delimiters intact. Its single-pass replacement fails against nested payloads such as an outer shortcode wrapping an inner one, because removing the outer tag reconstructs a valid inner tag. WordPress then evaluates the reconstructed shortcode during page rendering.
Attack Vector
Exploitation occurs over the network with no authentication and no user interaction. An attacker submits a public donation form and includes a nested shortcode payload in a donor field that is later echoed onto a public page. When any visitor or administrator loads that page, WordPress executes the injected shortcode. Refer to the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-85113
Indicators of Compromise
- Donation records containing shortcode delimiter characters ([, ]) in donor name, email, or comment fields
- Public donor pages rendering unexpected content sourced from other plugins or WordPress core shortcodes
- Web server access logs showing POST requests to GiveWP donation endpoints with URL-encoded shortcode payloads
- Outbound requests or data exposure originating from pages that display donor lists or receipts
Detection Strategies
- Query the WordPress database for donor metadata containing nested bracket patterns such as [[ or shortcode names embedded in donor-supplied fields
- Review page output for shortcodes that were not authored by site editors, particularly on donor-facing pages
- Correlate donation submissions with subsequent unusual PHP execution or plugin API calls
Monitoring Recommendations
- Enable WordPress audit logging for donation form submissions and inspect donor field content for shortcode syntax
- Monitor the GiveWP plugin version across all managed WordPress sites and alert on installations below 4.16.9
- Track anomalous read operations against user, options, or configuration tables initiated from front-end page renders
How to Mitigate CVE-2026-85113
Immediate Actions Required
- Upgrade GiveWP to version 4.16.9 or later on all WordPress installations
- Audit existing donation records for shortcode delimiters in donor-supplied fields and sanitize or remove suspicious entries
- Review installed plugins and disable any that register shortcodes exposing sensitive data or privileged actions
Patch Information
GiveWP resolved the issue in version 4.16.9. The fix removes shortcode delimiters from donor-supplied values and applies stripping recursively to defeat nested shortcode payloads. Consult the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict public donation forms behind CAPTCHA or rate limiting to reduce automated submission of malicious payloads
- Deploy a web application firewall rule that blocks donation form submissions containing shortcode delimiter characters in name, email, or comment fields
- Temporarily disable public rendering of donor names or comments until the plugin is upgraded
# Example WP-CLI command to check installed GiveWP version
wp plugin get give --field=version
# Upgrade GiveWP to the patched release
wp plugin update give --version=4.16.9
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
