WordPress kk Star Ratings Pre-Auth Arbitrary Shortcode Execution Vulnerability (CVE-2026-3424)

Vulnerability Overview Vulnerability Name: kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter CVE ID: CVE-2026-3424 CVSS Score: 5.3 (Medium) Publication Date: August 21, 2026 Last Updated: August 22, 2026 Researcher: Ronnachai Sretawat Na Ayutaya (Simonhasakelly) - Reconix Co., Ltd. Affected Range Affected Versions: <= 5.4.10.3 Fixed Version: 5.4.10.4 Software Type: Plugin Software Name: kk Star Ratings – Rate Post & Collect User Feedbacks Software Link: view on wordpress.org Remediation Recommendation: Update to version 5.4.10.4 or a later patched version. Vulnerability Description The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the payload value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Reference Links plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Share Options Facebook Twitter LinkedIn Email Additional Information Business Hours: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response Time: 24-hour support, 365 days a year, with a 1-hour response time. Copyright Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Twitter Facebook LinkedIn Instagram Products and Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscribe for Updates Subscription: Sign up for news and updates from our panel of experienced security professionals. Email: example@example.com Agreement: By checking this box I agree to the terms of service and privacy policy. Register Button Sign Up: SIGN UP

Goal Reached Thanks to every supporter — we hit 100%!

WordPress kk Star Ratings Pre-Auth Arbitrary Shortcode Execution Vulnerability (CVE-2026-3424)

More from this source