Better Notifications for WP <= 1.10 - Unauthenticated Arbitrary Shortcode Execution via Comment Fields
- ID
- WPSEC-2026-2273
- Plugin
- Customize WordPress Emails and Alerts – Better Notifications for WP (bnfw)
- Affected
- all versions before 1.10.2
- Remediation
- Update to 1.10.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- Better Notifications for WP on WPSec AttackSurface
- Fix released
- Published
Description
The Customize WordPress Emails and Alerts – Better Notifications for WP plugin for WordPress is vulnerable to arbitrary shortcode execution via notification merge tags such as [comment_content], [comment_author], [comment_author_url] and [comment_agent] in all versions up to, and including, 1.10. This is due to the plugin inserting user-supplied values into the notification message without neutralizing square brackets, then running do_shortcode() over the whole message with every registered shortcode active. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by posting a comment, when a comment notification that uses these merge tags is enabled (the plugin's default comment template uses them). Authenticated users can do the same through post titles, category and tag names, and author display names.
References
- https://wpsec.com/vuln/WPSEC-2026-2273/
- https://plugins.svn.wordpress.org/bnfw/tags/1.10.2/
- https://wordpress.org/plugins/bnfw/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS