Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-86604— GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation

Quick assessment

Affected

Unknown GTranslate

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GTranslate WordPress 插件在 5.0.1 版本之前，在展开短代码之前未从外发邮件的内容中移除短代码，这在非默认配置下会导致未经身份验证的用户能够注册并执行任意短代码，并在服务器端执行。

CVSS 4.8 · Medium EPSS 0.24% · P16 Updated Sep 23, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Unknown	GTranslate	`< 5.0.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation

Source: CVE Program / CVE List V5

Vulnerability Description

The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	GTranslate	0 ~ 5.0.1	-

II. Public POCs for CVE-2026-86604

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-86604

请登录查看更多情报信息。

Other References for CVE-2026-86604 (1)

https://wpscan.com/vulnerability/07c6e3a2-e8fe-4b25-a5d8-b5ed812100af/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-86604

Same Patch Batch · Unknown · 2026-09-23 · 57 CVEs total

CVE-2026-86601	6.5 MEDIUM	WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Conte
CVE-2026-86612	5.6 MEDIUM	Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Dat
CVE-2026-84091	5.3 MEDIUM	SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forge
CVE-2026-90950	5.3 MEDIUM	Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form
CVE-2026-87978	5.3 MEDIUM	Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscripti
CVE-2026-87071	5.3 MEDIUM	Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts
CVE-2026-87070	5.3 MEDIUM	Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing
CVE-2026-87848	3.7 LOW	MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure
CVE-2026-91073		Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting
CVE-2026-86842		Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings O
CVE-2026-93511		Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass
CVE-2026-91024		Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)
CVE-2026-89331		FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Pub
CVE-2026-88997		JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
CVE-2026-87981		Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and
CVE-2026-87074		Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attac
CVE-2026-87979		Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via W
CVE-2026-88929		Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure
CVE-2026-87069		Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe
CVE-2026-86783		PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API

Showing top 20 of 57 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: Unknown