Executive brief
The kk Star Ratings WordPress plugin, used to collect user ratings and feedback on posts, allows attackers to execute arbitrary WordPress shortcodes without authentication. This could enable attackers to extract sensitive data, modify content, or inject malicious code into the website, potentially compromising the entire WordPress installation.
Technical details
The plugin contains an arbitrary shortcode execution vulnerability in its AJAX handler (wp_ajax_kk-star-ratings.php). The vulnerable code fails to properly validate the 'payload' parameter before passing it to WordPress's do_shortcode() function. Since the action is not protected by proper authorization checks, unauthenticated attackers can send crafted requests with malicious shortcode payloads via the AJAX endpoint. This allows execution of arbitrary shortcodes, which can access sensitive WordPress functions and data. The vulnerability affects all versions up to and including 5.4.10.3.
Affected products
- kk Star Ratings kk Star Ratings up to and including 5.4.10.3
Timeline
- 2026-08-22: disclosed