CVE-2026-86604 in GTranslate Plugin
Summary
by MITRE • 09/23/2026
The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in versions of the GTranslate WordPress plugin prior to 5.0.1 represents a significant security flaw rooted in improper input validation and output encoding practices during email generation processes. The core technical issue arises from the plugin's failure to strip or neutralize shortcodes embedded within content before that content is processed for inclusion in outgoing emails. In standard WordPress architecture, shortcodes are placeholders that allow users to embed complex functionality into posts using simple tags. When these shortcodes are not removed prior to server-side execution during email rendering, they remain active and subject to interpretation by the WordPress engine. This behavior creates a critical attack vector because it bypasses the intended isolation of shortcode execution contexts, allowing code defined in one part of the application or even injected via external means to be executed within another context where such execution was not anticipated or secured.
From an operational perspective, this flaw allows unauthenticated attackers to achieve arbitrary server-side code execution under specific configuration conditions. The vulnerability is particularly dangerous because it does not require user authentication, making it accessible to any internet actor who can trigger the email generation process. In a non-default configuration where additional shortcodes are registered by other plugins or custom themes, an attacker can exploit this lack of sanitization to force the server to execute these arbitrary shortcodes. This effectively grants the attacker the ability to run PHP code with the same privileges as the web application itself. The impact is severe, potentially leading to full site compromise, data exfiltration, defacement, or the installation of persistent backdoors such as web shells.
This vulnerability aligns closely with CWE-94, which describes Improper Control of Generation of Code (Code Injection), specifically when untrusted input influences code execution without proper validation. Furthermore, it maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, particularly sub-techniques related to PHP scripting if the executed shortcodes invoke PHP functions. The attack path typically involves an attacker identifying a target site running the vulnerable version of GTranslate and then manipulating input fields that feed into email notifications, such as contact forms or comment sections, depending on how the plugin integrates with WordPress core mail functions. By injecting malicious shortcode payloads into these inputs, the attacker ensures that when the system attempts to send an email containing this content, it inadvertently processes the payload server-side rather than treating it as plain text or safe HTML.
Mitigation strategies must prioritize immediate patching of the GTranslate plugin to version 5.0.1 or later, where the developers have addressed this oversight by implementing proper sanitization routines that strip shortcodes before email processing begins. Administrators should also review their server configurations and WordPress installations for any custom plugins that register new shortcodes, as these become high-value targets once the isolation boundary is breached. Implementing a Web Application Firewall (WAF) with rules designed to detect suspicious shortcode patterns in HTTP requests can provide an additional layer of defense against exploitation attempts while patches are being applied. Additionally, enforcing strict Content Security Policy headers and disabling unnecessary email notifications for public-facing forms can reduce the attack surface by limiting the contexts in which user-supplied content is processed server-side. Regular security audits focusing on input validation and output encoding practices across all active plugins are essential to prevent similar vulnerabilities from arising in other components of the WordPress ecosystem.