CVE-2026-3475: 
WordPress vulnerability analysis and mitigation

CVE-2026-3475 is an Unauthenticated Arbitrary Shortcode Execution vulnerability in the Instant Popup Builder plugin for WordPress, affecting all versions up to and including 1.1.7. The flaw allows unauthenticated remote attackers to inject and execute arbitrary registered WordPress shortcodes by crafting a malicious token GET parameter. It was published on March 19, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, ENISA EUVD).

The root cause is a combination of missing authorization (CWE-862) and insufficient input sanitization in the handle_email_verification_page() function, which is hooked to WordPress's init action without any capability or nonce checks. The function constructs a shortcode string from user-supplied GET parameters (token and email) and passes it directly to do_shortcode(). Although sanitize_text_field() and esc_attr() are applied, neither strips square bracket characters ([ and ]). Because WordPress's shortcode regex uses [^\]\/]* to match content inside shortcode tags, a ] character injected into the token parameter prematurely closes the constructed shortcode tag, allowing an attacker to append arbitrary shortcode syntax that WordPress then executes (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to execute any shortcode registered on the target WordPress site, which can lead to unintended content rendering, data exposure through information-disclosing shortcodes, or abuse of shortcodes that perform privileged actions (e.g., form submissions, content injection). The integrity impact is rated Low with no direct confidentiality or availability impact under the base CVSS score; however, the actual impact depends heavily on which shortcodes are registered and their capabilities on the affected site (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.045% (0.000450), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable if a target is identified (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Instant Popup Builder plugin (versions ≤ 1.1.7) using tools like WPScan, Shodan, or by checking /wp-content/plugins/instant-popup-builder/ for plugin presence.
2. Locate the vulnerable endpoint: The vulnerable function is triggered via the WordPress init hook when specific GET parameters are present in the request URL (typically a page that processes email verification).
3. Craft the malicious token parameter: Construct a GET request where the token parameter contains a ] character to prematurely close the plugin-constructed shortcode, followed by the desired shortcode syntax. For example: ?token=x][your_shortcode]&email=test@example.com
4. Send the request: Submit the crafted HTTP GET request to the target WordPress site. No authentication or session token is required.
5. Observe shortcode execution: WordPress's do_shortcode() processes the injected shortcode server-side. Depending on the registered shortcodes available, the attacker can trigger content rendering, data retrieval, or other shortcode-defined actions (Wordfence, WordPress Trac).

• Network: Unusual HTTP GET requests to WordPress pages containing token parameters with ] characters and shortcode syntax (e.g., token=x][shortcode_name]); requests originating from automated scanners or unfamiliar IPs targeting email verification endpoints.
• Logs: WordPress access logs showing GET requests with URL-encoded %5D (closing bracket) characters in the token or email query parameters; repeated requests to the same endpoint from a single IP in a short timeframe.
• Application: Unexpected shortcode output rendered in HTTP responses for unauthenticated requests; server-side execution of shortcodes not associated with any legitimate page load.

Users should update the Instant Popup Builder plugin to a version beyond 1.1.7 that addresses this vulnerability. The fix involves either stripping or escaping square bracket characters in the token and email parameters before constructing the shortcode string, and adding proper authorization checks to the init hook handler. A patch changeset is available in the WordPress plugin repository (WordPress Trac Changeset). As a temporary workaround, site administrators can deactivate the plugin until a patched version is installed, or use a Web Application Firewall (WAF) rule to block requests containing shortcode syntax in GET parameters.

The vulnerability was disclosed by Wordfence, which published the advisory on March 19, 2026. A technical write-up was also published by Infinit Security shortly after disclosure (Infinit Security). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.