Arbitrary Shortcode Execution Vulnerability in AMP for WP Plugin by WordPress

CVE-2026-103908

What is CVE-2026-103908?

The AMP for WP – Accelerated Mobile Pages plugin for WordPress has a security flaw that enables arbitrary shortcode execution in all versions up to and including 1.1.18. This vulnerability arises from inadequate value validation when executing shortcodes through user actions. Authenticated users with custom-level access can exploit this weakness, granting them the ability to run unauthorized shortcodes on affected sites. The exposure is exacerbated as the vulnerable output block, governed by the 'ampforwp-cat-description' setting, is enabled by default in most installations, leaving numerous sites at risk unless specifically configured otherwise.

References