CVE-2026-12757: 
WordPress vulnerability analysis and mitigation

CVE-2026-12757 is an arbitrary shortcode execution vulnerability in the Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress by Icegram. It affects all versions up to and including 5.9.27, allowing unauthenticated remote attackers to execute arbitrary WordPress shortcodes without any privileges or user interaction. The vulnerability was published on September 7, 2026, and assigned a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The plugin exposes a user-executable action that passes user-supplied input directly to WordPress's do_shortcode() function without adequate validation or sanitization, allowing any value to be interpreted as a shortcode (GitHub Advisory). The vulnerable code paths are present in multiple files, including class-es-handle-subscription.php (lines 165 and 260), class-es-mailer.php (line 1133), and class-es-action-send-email.php (line 188) (Wordfence). No authentication or special privileges are required, and the attack can be automated over the network with low complexity.

Successful exploitation allows unauthenticated attackers to execute arbitrary WordPress shortcodes, which can expose sensitive site information or manipulate website functionality depending on the shortcodes registered on the target site. The confidentiality and integrity impacts are rated as low, with no direct availability impact; however, certain shortcodes (e.g., those from other installed plugins) could be leveraged to escalate impact, exfiltrate data, or alter site content (GitHub Advisory, Wordfence).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Wordfence). The NVD SSVC assessment notes the attack is automatable with partial technical impact and no known exploitation. The EPSS score is approximately 0.33% (26th percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running the Email Subscribers & Newsletters plugin (version ≤ 5.9.27) using tools like WPScan, Shodan, or by inspecting plugin directories at /wp-content/plugins/email-subscribers/.
2. Identify the vulnerable action: Locate the unauthenticated AJAX or form action exposed by the plugin that triggers the shortcode execution path (e.g., subscription-related endpoints handled by class-es-handle-subscription.php).
3. Craft malicious request: Send an HTTP POST request to the vulnerable endpoint with a crafted payload containing an arbitrary WordPress shortcode in the relevant parameter (e.g., [some_shortcode]).
4. Trigger do_shortcode: The plugin processes the unvalidated input through do_shortcode(), executing the attacker-supplied shortcode in the WordPress context.
5. Achieve objective: Depending on shortcodes available on the target site, the attacker may extract sensitive data, trigger plugin functionality, or manipulate site content (GitHub Advisory, Wordfence).

• Network: Unusual POST requests to WordPress subscription or email-related endpoints (e.g., paths handled by the email-subscribers plugin) containing shortcode syntax ([...]) in parameter values; high-frequency automated requests from a single IP to these endpoints.
• Logs: WordPress access logs showing repeated requests to plugin AJAX handlers (wp-admin/admin-ajax.php with plugin-specific action parameters) with shortcode-like payloads in POST body; PHP error logs referencing do_shortcode calls from class-es-handle-subscription.php or class-es-mailer.php.
• File System: Unexpected modifications to plugin files or new files created in the email-subscribers plugin directory.
• Process: Unusual PHP process activity triggered by shortcode execution, such as outbound HTTP requests or file writes initiated from the web server process.

Update the Email Subscribers & Newsletters plugin to a version greater than 5.9.27, which contains the fix for this vulnerability (GitHub Advisory, Wordfence). As a temporary workaround, consider restricting access to plugin-specific AJAX endpoints via a Web Application Firewall (WAF) or by limiting shortcode execution to authenticated users with appropriate permissions. Site administrators should also audit registered shortcodes to minimize the potential impact of any shortcode being executed by an unauthorized party.

The vulnerability was reported and disclosed by Wordfence, which assigned it a medium severity rating. No significant broader media coverage or notable researcher commentary beyond the initial advisory has been identified at this time.