{
 "id": "WPSEC-2026-2273",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2273/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2273/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2273/index.md",
 "title": "Better Notifications for WP <= 1.10 - Unauthenticated Arbitrary Shortcode Execution via Comment Fields",
 "description": "The Customize WordPress Emails and Alerts – Better Notifications for WP plugin for WordPress is vulnerable to arbitrary shortcode execution via notification merge tags such as [comment_content], [comment_author], [comment_author_url] and [comment_agent] in all versions up to, and including, 1.10. This is due to the plugin inserting user-supplied values into the notification message without neutralizing square brackets, then running do_shortcode() over the whole message with every registered shortcode active. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by posting a comment, when a comment notification that uses these merge tags is enabled (the plugin's default comment template uses them). Authenticated users can do the same through post titles, category and tag names, and author display names.",
 "plugin": {
  "slug": "bnfw",
  "name": "Better Notifications for WP",
  "full_name": "Customize WordPress Emails and Alerts – Better Notifications for WP",
  "wordpress_org": "https://wordpress.org/plugins/bnfw/",
  "advisories_url": "https://wpsec.com/vuln/plugin/bnfw/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/bnfw"
 },
 "type": "RCE",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.10.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.10.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.10.2",
 "remediation": "Update to 1.10.2 or later.",
 "fix_released": "2026-10-31T08:42:47+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:22:44.432902+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2273/",
  "https://plugins.svn.wordpress.org/bnfw/tags/1.10.2/",
  "https://wordpress.org/plugins/bnfw/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/bnfw",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}