Description

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-22T12:16:24.677Z",
  "pubdate": "2026-08-22T12:16:24.677Z",
  "executiveSummary": "The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is susceptible to an arbitrary shortcode execution vulnerability across all versions up to, and including, 5.4.10.3. This security flaw enables unauthenticated malicious actors to execute arbitrary shortcodes within the context of the vulnerable application.\nThe root of the issue lies in the application logic processing user-supplied input via the 'payload' parameter without implementing adequate validation or sanitization before passing the data to the do_shortcode function.\nThe primary impact of this vulnerability includes potential remote code execution, sensitive data disclosure, or Server-Side Request Forgery depending on which registered shortcodes are present and exploitable within the WordPress environment.\nAttackers do not require any prior authentication or privileged access to initiate exploitation, lowering the attack barrier significantly and posing a severe risk to affected WordPress installations.\nDefense and remediation efforts require updating the plugin to a patched version once available or restricting untrusted input handling within the affected functionality.",
  "technicalDetails": "The vulnerability resides in the input handling mechanism of the kk Star Ratings – Rate Post & Collect User Feedbacks plugin, specifically within the handling of the 'payload' parameter across all versions up to, and including, 5.4.10.3.\nThe root cause of the flaw is the direct passing of unvalidated or insufficiently sanitized user input from the 'payload' value directly into the WordPress do_shortcode core function. Because shortcodes in WordPress can often invoke complex PHP logic, database queries, or render restricted template components depending on installed plugins and themes, granting external control over the shortcode execution pipeline introduces severe security risks.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious HTTP request targeting the vulnerable action endpoint exposed by the plugin. Within this request, the attacker injects the targeted shortcode payload via the unprotected 'payload' parameter. Second, the plugin processes the incoming request and forwards the raw, attacker-controlled 'payload' string into the do_shortcode function without performing proper input validation or capability checks. Third, the WordPress core execution engine parses and evaluates the injected shortcode string.\nBecause the vulnerability requires no authentication or special privilege levels, any remote network attacker can interact directly with the vulnerable endpoint over standard HTTP/HTTPS protocols. The exploitation vector is exposed externally, making automated exploitation trivial for malicious actors.\nDepending on the architecture of the target WordPress environment and the presence of vulnerable third-party or core shortcodes, the post-exploitation impact ranges from information disclosure via data-retrieval shortcodes to remote code execution when interacting with poorly implemented shortcodes that evaluate dynamic PHP code or execute system commands."
}