Security Alert Summary
The GTranslate WordPress plugin prior to version 5.0.1 fails to remove shortcodes from the content of outgoing emails before expanding them. In non-default configurations this can allow unauthenticated users to register arbitrary shortcodes that are executed server side when those emails are processed.
CVE Details
- CVE ID: CVE-2026-86604
- Affected component: GTranslate WordPress plugin
- Affected versions: versions less than 5.0.1 (before 5.0.1)
- Published: September 23, 2026 at 11:17:14 AM
- Last modified: September 23, 2026 at 11:17:14 AM
- CVSS v3.1: Base score 4.8 (MEDIUM) —
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: NONE; user interaction: NONE; attack vector: NETWORK; attack complexity: HIGH; scope: UNCHANGED
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-74
Technical Details
The plugin does not remove shortcodes from the content of outgoing emails before expanding them. When the site is configured in a non-default way that permits unauthenticated users to register shortcodes, those shortcodes can be expanded server side during email processing, resulting in execution of the registered shortcode handlers.
The CVE description does not name specific functions, hooks, or REST API endpoints. Based on the provided data, no specific function names or endpoints are cited.
The impact is limited to server-side execution of shortcodes that an attacker can register in the affected configuration. The CVSS metrics indicate limited confidentiality and integrity impact and no availability impact, with a higher attack complexity required.
How This Could Impact Your Website
Consider a site with multiple users: a site owner who manages plugins and settings, internal staff who publish content, and an external contractor or contributor who can submit content or interact with forms. If the site is using a non-default configuration that allows unauthenticated shortcode registration, an attacker could register shortcodes that execute when outgoing emails are processed. This could lead to exposure of information included in those emails or execution of shortcode handlers that access site data.
Practical consequences include exposure of internal user email addresses and an increased risk of targeted phishing or social engineering against staff or contractors. The integrity of certain content elements rendered via shortcodes could also be affected, consistent with the CVSS impacts.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and any settings that permit unauthenticated content registration.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase attack surface.
- Monitor site activity and outgoing email processing for unusual behavior.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
