WordPress kk Star Ratings 未授权任意短代码执行漏洞 (CVE-2026-3424)

漏洞概述 漏洞名称: kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter CVE ID: CVE-2026-3424 CVSS 评分: 5.3 (Medium) 发布日期: August 21, 2026 最后更新日期: August 22, 2026 研究人员: Ronnachai Sretawat Na Ayutaya (Simonhasakelly) - Reconix Co., Ltd. 影响范围 受影响版本: <= 5.4.10.3 修复版本: 5.4.10.4 软件类型: Plugin 软件名称: kk Star Ratings – Rate Post & Collect User Feedbacks 软件链接: view on wordpress.org 修复方案 修复建议: 更新到版本 5.4.10.4 或更新的已修补版本 漏洞描述 The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the payload value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. 参考链接 plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org 分享选项 Facebook Twitter LinkedIn Email 其他信息 业务时间: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. 响应时间: 24-hour support, 365 days a year, with a 1-hour response time. 版权信息 版权: © 2012-2026 Defiant Inc. All Rights Reserved 其他链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 Twitter Facebook LinkedIn Instagram 产品和支持 Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form 订阅更新 订阅: Sign up for news and updates from our panel of experienced security professionals. 邮箱: example@example.com 同意条款: By checking this box I agree to the terms of service and privacy policy. 注册按钮 Sign Up: SIGN UP 其他信息 业务时间: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. 响应时间: 24-hour support, 365 days a year, with a 1-hour response time. 版权信息 版权: © 2012-2026 Defiant Inc. All Rights Reserved 其他链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 Twitter Facebook LinkedIn Instagram 产品和支持 Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form 订阅更新 订阅: Sign up for news and updates from our panel of experienced security professionals. 邮箱: example@example.com 同意条款: By checking this box I agree to the terms of service and privacy policy. 注册按钮 Sign Up: SIGN UP 其他信息 业务时间: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. 响应时间: 24-hour support, 365 days a year, with a 1-hour response time. 版权信息 版权: © 2012-2026 Defiant Inc. All Rights Reserved 其他链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 Twitter Facebook LinkedIn Instagram 产品和支持 Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form 订阅更新 订阅: Sign up for news and updates from our panel of experienced security professionals. 邮箱: example@example.com 同意条款: By checking this box I agree to the terms of service and privacy policy. 注册按钮 Sign Up: SIGN UP 其他信息 业务时间: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. 响应时间: 24-hour support, 365 days a year, with a 1-hour response time. 版权信息 版权: © 2012-2026 Defiant Inc. All Rights Reserved 其他链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 Twitter Facebook LinkedIn Instagram 产品和支持 Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form 订阅更新 订阅: Sign up for news and updates from our panel of experienced security professionals. 邮箱: example@example.com 同意条款: By checking this box I agree to the terms of service and privacy policy. 注册按钮 Sign Up: SIGN UP 其他信息 业务时间: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. 响应时间: 24-hour support, 365 days a year, with a 1-hour response time. 版权信息 版权: © 2012-20

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

WordPress kk Star Ratings 未授权任意短代码执行漏洞 (CVE-2026-3424)

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

WordPress kk Star Ratings 未授权任意短代码执行漏洞 (CVE-2026-3424)

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！