CVE-2026-86604 Overview
CVE-2026-86604 affects the GTranslate WordPress plugin in versions prior to 5.0.1. The plugin fails to strip shortcodes from outgoing email content before expansion. In a non-default configuration, this allows unauthenticated attackers to trigger execution of arbitrary registered shortcodes on the server side. The flaw is classified under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component. Exploitation depends on which shortcodes are registered on the target site, since impact scales with the capabilities exposed by those shortcodes.
Critical Impact
Unauthenticated attackers can cause the WordPress instance to execute arbitrary registered shortcodes server-side through crafted email content, leading to limited confidentiality and integrity impact.
Affected Products
- GTranslate WordPress plugin versions before 5.0.1
- WordPress sites running GTranslate in a non-default configuration
- Sites with additional shortcode-registering plugins active alongside GTranslate
Discovery Timeline
- 2026-09-23 - CVE-2026-86604 published to the National Vulnerability Database (NVD)
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-86604
Vulnerability Analysis
The GTranslate plugin processes outgoing email content and expands embedded content without first stripping WordPress shortcodes. WordPress shortcodes use the [shortcode_name] syntax and trigger registered PHP handlers when parsed by do_shortcode(). When attacker-controlled input reaches the email pipeline, any shortcode registered by the site's active plugins or theme becomes reachable through the shortcode expansion step.
The issue applies only in a non-default configuration, which limits the exposed attack surface. Impact depends entirely on which shortcodes exist on the target. Some shortcodes only render benign markup, while others expose sensitive data or trigger state-changing actions.
Root Cause
The root cause is missing sanitization of user-controllable input before shortcode expansion. The plugin invokes shortcode processing on email content without a preceding call to strip_shortcodes() or equivalent filtering. This produces an injection sink of the type described by [CWE-74], where special syntax elements pass through unmodified into a downstream interpreter.
Attack Vector
An unauthenticated attacker submits input that reaches an outgoing email generated by the site, embedding one or more shortcodes in the payload. When GTranslate processes the outgoing message, the WordPress shortcode parser executes the embedded shortcodes with the privileges of the PHP worker. See the WPScan Vulnerability Advisory for reproduction details.
No verified public exploit code is available. The attack requires the target site to register shortcodes that yield useful side effects when triggered by an unauthenticated actor.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-86604
Indicators of Compromise
- Outbound emails from the WordPress instance containing rendered content that originated from shortcode expansion of externally submitted data
- Web server access logs showing unauthenticated POST requests to endpoints that generate outgoing mail, with bodies containing [ and ] characters wrapping shortcode names
- Unexpected invocations of registered shortcode handlers in PHP error or debug logs correlated with mail-sending code paths
Detection Strategies
- Inventory installed WordPress plugins and confirm GTranslate version. Flag any instance below 5.0.1.
- Inspect email templates and mail-sending flows for calls to do_shortcode() on content derived from unauthenticated input.
- Correlate mail queue entries with recent unauthenticated HTTP requests to identify anomalous shortcode strings passing through the mail pipeline.
Monitoring Recommendations
- Enable WordPress debug logging and capture invocations of shortcode handlers with source context.
- Forward web server, PHP-FPM, and mail transport logs to a centralized data lake for cross-source correlation.
- Alert on outbound SMTP messages that contain shortcode syntax in the rendered body, which indicates improper stripping.
How to Mitigate CVE-2026-86604
Immediate Actions Required
- Update the GTranslate WordPress plugin to version 5.0.1 or later on every affected site.
- Audit the list of registered shortcodes and disable any that expose sensitive data or state-changing operations when invoked without authentication.
- Review the plugin configuration and revert to defaults where feasible, since the vulnerable path requires a non-default setup.
Patch Information
GTranslate version 5.0.1 removes shortcodes from outgoing email content before expansion. Refer to the WPScan Vulnerability Advisory for the fixed version and advisory metadata.
Workarounds
- Deactivate the GTranslate plugin until the site can be updated to 5.0.1.
- Restrict which shortcodes are registered by disabling non-essential plugins that expose powerful shortcode handlers.
- Place a Web Application Firewall (WAF) rule in front of the site to block unauthenticated request bodies containing shortcode syntax targeting known email-generating endpoints.
# Update GTranslate via WP-CLI
wp plugin update gtranslate --version=5.0.1
# Verify installed version
wp plugin get gtranslate --field=version
# Temporary mitigation: deactivate the plugin
wp plugin deactivate gtranslate
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
