Executive brief
The WP Blockade plugin for WordPress, a tool used for visual page building, contains a security flaw that allows any logged-in user to execute arbitrary shortcodes. This could allow low-level users, such as subscribers, to access sensitive information or perform unauthorized actions by triggering functionality from other installed plugins. Such an exploit could lead to the exposure of private customer data or unauthorized changes to the website's configuration.
Technical details
The vulnerability is classified as Missing Authorization (CWE-862) within the 'render_shortcode_preview' function, which is mapped to the 'wp-blockade-shortcode-render' admin_post action hook. The function fails to implement capability checks (current_user_can()) or nonce verification. An attacker with Subscriber-level access or higher can provide a 'shortcode' parameter via a GET request, which is then processed by stripslashes() and executed through do_shortcode(). This enables the execution of any shortcode registered on the WordPress site, potentially leading to information disclosure or privilege escalation depending on the available shortcode library.
Affected products
- burlingtonbytes WP Blockade – Visual Page Builder 0.9.14 and below
Timeline
- 2026-04-08: advisory: Initial disclosure by Wordfence and NVD publication.
References
- https://plugins.trac.wordpress.org/browser/wp-blockade/tags/0.9.14/wp-blockade.php
- https://plugins.trac.wordpress.org/browser/wp-blockade/tags/0.9.14/wp-blockade.php
- https://plugins.trac.wordpress.org/browser/wp-blockade/tags/0.9.14/wp-blockade.php
- https://plugins.trac.wordpress.org/browser/wp-blockade/trunk/wp-blockade.php
- https://plugins.trac.wordpress.org/browser/wp-blockade/trunk/wp-blockade.php
- https://plugins.trac.wordpress.org/browser/wp-blockade/trunk/wp-blockade.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3f159aac-092b-4655-9d97-a496ac01738c?source=cve