CVE-2026-103908: Accelerate arbitrary shortcode

CISO Take

The AMP for WP – Accelerated Mobile Pages plugin up to version 1.1.18 passes an unvalidated value to do_shortcode, so any authenticated user with custom-level (contributor-type) access can run arbitrary WordPress shortcodes. This is a WordPress content plugin, not an AI/ML component. Its classification as an ML library and its listing under pip look like a data-mapping artifact, so treat the AI relevance as minimal. The CVSS score is a moderate 5.4 (low confidentiality and integrity impact). It is not in CISA KEV, has no public exploit or Nuclei template, and EPSS and SSVC data are not yet available. The risk is wider than the score suggests because the vulnerable output block depends on the 'ampforwp-cat-description' setting, which is on by default. Update to a release newer than 1.1.18 once the vendor publishes a fix (no patched version is listed in the source data yet). Until then, review which accounts hold contributor-level roles, and disable the category-description option if you don't need it.

Sources:NVDWordfenceWordPress Plugin TracOpenSSFATLAS

What is the risk?

Medium. Exploitation needs network access and a low-privilege authenticated account, but no user interaction and low complexity. Impact is limited to low confidentiality and integrity loss, with no availability impact. The real severity depends on which shortcodes are installed: a plugin that exposes file, database, or code-running shortcodes could turn this into something worse than the base score. The default-on setting means most installs are exposed. There is no evidence of active exploitation, no KEV listing, and no public exploit. EPSS is not available, so the exploitation likelihood is unquantified. The package risk score is low (28/100) and the OpenSSF Scorecard is a middling 6.7/10.

How does the attack unfold?

Initial Access

The attacker obtains or creates a low-privilege authenticated account (contributor or custom role) on the WordPress site.

AML.T0012

Exploitation

The attacker supplies a crafted shortcode value that reaches do_shortcode through the category-description output block, which is enabled by default.

AML.T0049

Impact

Arbitrary shortcodes run, which can expose or alter content and trigger other plugins' functions, such as AI or chatbot embeds.

Initial Access

The attacker obtains or creates a low-privilege authenticated account (contributor or custom role) on the WordPress site.

AML.T0012

Exploitation

The attacker supplies a crafted shortcode value that reaches do_shortcode through the category-description output block, which is enabled by default.

AML.T0049

Impact

Arbitrary shortcodes run, which can expose or alter content and trigger other plugins' functions, such as AI or chatbot embeds.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Accelerate	pip	—	No patch
9.9KOpenSSF 6.73.1K dependentsPushed 6d ago25% patched~6d to patchFull package profile →

Do you use Accelerate? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

1) Update AMP for WP to the first release after 1.1.18 as soon as the vendor provides one, and check the Wordfence advisory for the exact fixed version. 2) Until patched, disable the category description output in the AMP settings (the 'ampforwp-cat-description' option) if it isn't needed. 3) Restrict contributor and custom roles to trusted users, and remove unused accounts. 4) Audit installed plugins for shortcodes that expose sensitive functionality (file access, database queries, AI or chatbot embeds) and disable the ones you don't use. 5) Review web server and WordPress logs for unusual AMP category-page requests and for unexpected shortcode output. 6) Add a WAF rule or virtual patch if your provider offers one for this plugin.

How is it classified?

Code ExecutionPluginAML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MANAGE 2.3-Risk treatment, including third-party components

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-103908?

The AMP for WP – Accelerated Mobile Pages plugin up to version 1.1.18 passes an unvalidated value to do_shortcode, so any authenticated user with custom-level (contributor-type) access can run arbitrary WordPress shortcodes. This is a WordPress content plugin, not an AI/ML component. Its classification as an ML library and its listing under pip look like a data-mapping artifact, so treat the AI relevance as minimal. The CVSS score is a moderate 5.4 (low confidentiality and integrity impact). It is not in CISA KEV, has no public exploit or Nuclei template, and EPSS and SSVC data are not yet available. The risk is wider than the score suggests because the vulnerable output block depends on the 'ampforwp-cat-description' setting, which is on by default. Update to a release newer than 1.1.18 once the vendor publishes a fix (no patched version is listed in the source data yet). Until then, review which accounts hold contributor-level roles, and disable the category-description option if you don't need it.

Is CVE-2026-103908 actively exploited?

No confirmed active exploitation of CVE-2026-103908 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-103908?

1) Update AMP for WP to the first release after 1.1.18 as soon as the vendor provides one, and check the Wordfence advisory for the exact fixed version. 2) Until patched, disable the category description output in the AMP settings (the 'ampforwp-cat-description' option) if it isn't needed. 3) Restrict contributor and custom roles to trusted users, and remove unused accounts. 4) Audit installed plugins for shortcodes that expose sensitive functionality (file access, database queries, AI or chatbot embeds) and disable the ones you don't use. 5) Review web server and WordPress logs for unusual AMP category-page requests and for unexpected shortcode output. 6) Add a WAF rule or virtual patch if your provider offers one for this plugin.

What systems are affected by CVE-2026-103908?

This vulnerability affects the following AI/ML architecture patterns: WordPress-hosted web front ends, CMS plugins that embed AI chatbot or RAG widgets.

What is the CVSS score for CVE-2026-103908?

CVE-2026-103908 has a CVSS v3.1 base score of 5.4 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

WordPress-hosted web front endsCMS plugins that embed AI chatbot or RAG widgets

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with custom-level access and above, to execute arbitrary shortcodes. The vulnerable output block is gated by the 'ampforwp-cat-description' setting, which is enabled by default, meaning the vast majority of installations are affected without any additional configuration change.

Exploitation Scenario

An attacker registers, or compromises, a low-privilege account with contributor-level or custom-role access on a WordPress site that uses AMP for WP. They craft input so that a shortcode string reaches the do_shortcode call in the plugin's category-description output. The site then runs the shortcode when the AMP category page renders. If the site also embeds an AI chatbot or a RAG search plugin through shortcodes, the attacker could invoke it to expose its configuration or data, or to inject unwanted content. The attacker then reads the output on the public AMP page.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code

CWE-94 — Improper Control of Generation of Code: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.