# Better Notifications for WP <= 1.10 - Unauthenticated Arbitrary Shortcode Execution via Comment Fields

- **ID:** WPSEC-2026-2273
- **Plugin:** Customize WordPress Emails and Alerts – Better Notifications for WP (`bnfw`), https://wordpress.org/plugins/bnfw/
- **Affected versions:** all versions before 1.10.2
- **Fixed in:** 1.10.2 (Update to 1.10.2 or later.)
- **Severity:** High 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/bnfw
- **Fix released:** 2026-10-31
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2273/

## Description

The Customize WordPress Emails and Alerts – Better Notifications for WP plugin for WordPress is vulnerable to arbitrary shortcode execution via notification merge tags such as [comment_content], [comment_author], [comment_author_url] and [comment_agent] in all versions up to, and including, 1.10. This is due to the plugin inserting user-supplied values into the notification message without neutralizing square brackets, then running do_shortcode() over the whole message with every registered shortcode active. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by posting a comment, when a comment notification that uses these merge tags is enabled (the plugin's default comment template uses them). Authenticated users can do the same through post titles, category and tag names, and author display names.

## References

- https://wpsec.com/vuln/WPSEC-2026-2273/
- https://plugins.svn.wordpress.org/bnfw/tags/1.10.2/
- https://wordpress.org/plugins/bnfw/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2273/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.