Description

The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with custom-level access and above, to execute arbitrary shortcodes. The vulnerable output block is gated by the 'ampforwp-cat-description' setting, which is enabled by default, meaning the vast majority of installations are affected without any additional configuration change.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T12:17:15.650Z",
  "pubdate": "2026-11-06T12:17:15.650Z",
  "executiveSummary": "The AMP for WP – Accelerated Mobile Pages plugin for WordPress contains a critical vulnerability permitting arbitrary shortcode execution.\nThis flaw resides in the handling of the 'ampforwp-cat-description' setting, which fails to perform sufficient input validation prior to the invocation of do_shortcode.\nThe vulnerability affects all versions up to and including 1.1.18. Since the vulnerable functionality is enabled by default, the majority of active installations are currently exposed.\nExploitation requires the attacker to possess authenticated access with at least custom-level privileges. Successful exploitation allows for the execution of arbitrary shortcodes within the WordPress environment.\nThis poses a significant risk to site integrity and data security, as attackers can leverage legitimate, yet unauthorized, shortcodes to trigger sensitive backend functions, exfiltrate data, or perform unauthorized administrative actions depending on the available shortcodes registered within the site environment.",
  "technicalDetails": "The root cause of this vulnerability is improper input sanitization and validation within the AMP for WP plugin. Specifically, the software processes user-supplied data associated with the 'ampforwp-cat-description' setting and passes this data directly to the WordPress do_shortcode function without ensuring the content adheres to expected formats or security constraints.\nIn the WordPress architecture, the do_shortcode function is designed to parse content for shortcode tags and execute the associated callback functions. By failing to validate the input, the plugin allows an authenticated user to inject malicious or unintended shortcode strings into the data processed by this function.\nThe exploitation flow begins when an authenticated attacker with custom-level access or higher interacts with the WordPress dashboard or relevant interface where the 'ampforwp-cat-description' setting can be manipulated. Because this setting is enabled by default, the attack surface is exposed without requiring additional configuration by the site administrator.\nAn attacker inputs a crafted shortcode string into the vulnerable field. Upon submission, the plugin stores this value. When the front-end or a specific process invokes the vulnerable code block, the system executes the attacker-supplied shortcode. This executes the logic associated with the shortcode, which may interact with the database, send requests, or perform other actions permitted by the WordPress API.\nThe impact of this vulnerability is contingent upon the shortcodes available in the environment. Many WordPress themes and plugins register shortcodes that provide extensive functionality. If a site has installed plugins with administrative or sensitive shortcodes, an attacker can leverage this execution path to perform those actions, effectively bypassing intended authorization controls for those specific features.\nThis vulnerability is restricted by the requirement for authentication, but because custom-level access is often granted to a broad range of users in many WordPress environments, the risk of exploitation remains high. The lack of validation creates a direct injection vector that treats attacker-controlled strings as executable code, fundamentally violating the principle of separation between data and execution logic."
}