CVE-2026-3424 in kk Star Ratings Plugin
Summary
by MITRE • 08/22/2026
The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in the kk Star Ratings plugin, specifically affecting versions up through 5.4.10.3, represents a critical security flaw rooted in improper input validation and insecure direct object reference patterns within WordPress shortcode handling mechanisms. This issue allows unauthenticated attackers to execute arbitrary shortcodes on affected sites, bypassing standard authentication requirements that typically protect administrative or user-specific functions. The core of the vulnerability lies in how the plugin processes incoming requests containing specific action parameters. When a request is received, the software attempts to render content by invoking the WordPress function do_shortcode without first verifying whether the payload value provided by the user corresponds to legitimate, whitelisted shortcodes defined by the application logic. This lack of validation creates an open channel for code injection at the presentation layer, enabling attackers to manipulate how page content is rendered dynamically during request processing.
From a technical perspective, this flaw aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically where user input directly influences the execution context without adequate sanitization or allowlisting. In WordPress environments, shortcodes are powerful tools that map to PHP functions capable of performing complex operations including database queries, file system access, and output generation. By exploiting this vulnerability, an attacker can inject malicious shortcode tags into HTTP requests which are then processed by the server-side rendering engine. Because the validation step is missing or flawed, any arbitrary string formatted as a valid WordPress shortcode syntax will be executed. This effectively turns the plugin's own functionality against its administrators and users, transforming a benign rating collection tool into an attack vector for remote code execution scenarios depending on what other plugins are active on the same site that might respond to specific shortcodes with dangerous side effects.
The operational impact of this vulnerability is severe due to its unauthenticated nature. Attackers do not need valid credentials or prior access to exploit it, significantly lowering the barrier to entry and increasing the likelihood of automated exploitation via web crawlers scanning for vulnerable instances across the internet. Successful exploitation can lead to a range of adverse outcomes including cross-site scripting if injected shortcodes output malicious JavaScript, data exfiltration through crafted requests that trigger database queries returning sensitive information, or privilege escalation if combined with other vulnerabilities in co-located plugins. Furthermore, because WordPress sites often share hosting environments and session cookies, compromising one site via this method can facilitate lateral movement within a shared infrastructure. The ability to execute arbitrary shortcodes also allows attackers to deface websites by injecting content that alters the visual appearance of pages or disrupts service availability through resource-intensive shortcode executions.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The primary and most effective mitigation is to update the kk Star Ratings plugin to version 5.4.10.4 or later, where developers have implemented proper input validation checks before invoking do_shortcode. Administrators should verify their WordPress installation for this specific plugin version immediately via the dashboard or command line tools like WP-CLI. For sites that cannot be updated instantly due to compatibility concerns with other themes or plugins, temporary mitigation involves using a Web Application Firewall configured with rulesets designed to detect and block malicious shortcode syntax patterns in POST and GET parameters. Additionally, implementing strict Content Security Policy headers can help mitigate the impact of any potential cross-site scripting vectors derived from this vulnerability by restricting script execution sources. Regular security audits focusing on input validation practices across all active plugins are essential to prevent similar flaws arising from inconsistent coding standards within the WordPress ecosystem.