Description

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-09-02T15:17:42.917Z",
  "pubdate": "2026-09-02T15:17:42.917Z",
  "executiveSummary": "The Brave WordPress plugin, in versions prior to 0.8.8, is susceptible to an unauthenticated shortcode injection vulnerability.\nThis flaw arises from inadequate sanitization and improper handling of user-supplied input provided via URL parameters designed for form field pre-filling.\nThe vulnerability allows an unauthenticated remote attacker to inject and execute arbitrary WordPress shortcodes on the server-side.\nSuccessful exploitation bypasses standard access controls, potentially leading to unauthorized data exposure, execution of administrative functions, or full site compromise depending on the shortcodes available within the WordPress environment.\nThe risk is critical due to the lack of required authentication or elevated privileges, making the site exploitable by any network-adjacent attacker capable of crafting a malicious URL request.\nRemediation requires an immediate update to version 0.8.8 or higher, as the vulnerability exposes the underlying application logic to external manipulation.",
  "technicalDetails": "The vulnerability resides in the plugin's handling of input parameters intended to pre-populate form fields. The application fails to properly validate or sanitize the data retrieved from URL parameters before passing them to the WordPress `do_shortcode()` function or the internal shortcode parsing engine.\nRoot cause analysis indicates that the plugin lacks a robust whitelist or sanitization layer for user-supplied data transmitted via GET requests. By injecting shortcode syntax (e.g., [shortcode_name]) into the vulnerable URL parameter, an attacker can coerce the server into evaluating the injected code as part of the page rendering process.\nAttack flow: The attacker identifies a URL parameter used by the Brave plugin to pre-fill a form field. The attacker crafts a malicious request containing a WordPress shortcode within this parameter. When the application processes the request, the plugin passes the unsanitized input to the WordPress shortcode processor. Because the input is processed server-side, the shortcode is executed with the privileges of the web server, regardless of the attacker's authentication status.\nThe exploitation does not require prior knowledge of specific shortcodes; an attacker may attempt to trigger publicly available shortcodes or those included by other installed plugins to exfiltrate information, execute actions, or induce denial-of-service conditions.\nThe attack is performed over standard HTTP/HTTPS channels, requiring only network reachability to the WordPress installation. No administrative privileges are required, as the input processing occurs during the initialization or request-handling phase of the plugin before any session-based authentication checks are enforced.\nPost-exploitation impact is highly dependent on the shortcodes registered in the environment. If an attacker can execute administrative shortcodes, they may be able to modify database content, retrieve sensitive user information, or leverage the server environment for further reconnaissance. The vulnerability effectively turns the user input mechanism into an arbitrary code execution vector within the context of the WordPress rendering engine."
}