Missing Authorization Vulnerability in WP Blockade Plugin for WordPress

CVE-2026-3480

What is CVE-2026-3480?

The WP Blockade plugin exposes a significant vulnerability where any authenticated user can exploit missing authorization checks in the 'wp-blockade-shortcode-render' admin_post action. This issue arises due to the absence of capability checks and nonce verification in the render_shortcode_preview() function. Consequently, users with at least Subscriber-level access are able to execute arbitrary shortcodes by providing a user-supplied 'shortcode' parameter. This poses serious risks, including unauthorized information disclosure and potential privilege escalation, as malicious shortcodes from other plugins may access sensitive data or execute unintended actions on the site.

References