CVE-2026-86803
Deferred Deferred - Pending Action

Arbitrary Shortcode Execution in Ocean Extra WordPress Plugin

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Wordfence

Description
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-86803
EUVD
EUVD-2026-101839

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
oceanwp Ocean Extra 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Ocean Extra plugin for WordPress has a flaw where it allows users to run an action that does not properly check a value before executing do_shortcode. This lets unauthenticated attackers run arbitrary shortcodes on affected sites.

Detection Guidance

Check for the presence of the Ocean Extra plugin in WordPress installations. Look for unauthorized shortcode execution attempts in logs or by inspecting plugin files for suspicious code.

Impact Analysis

An attacker could exploit this to execute malicious shortcodes, potentially leading to unauthorized actions, data theft, or further compromise of the WordPress site.

Compliance Impact

This vulnerability allows unauthenticated attackers to execute arbitrary shortcodes, which could lead to unauthorized data access, modification, or exfiltration. Such risks may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Update the Ocean Extra plugin to the latest version if available. If not, consider disabling or removing the plugin immediately. Monitor for unusual activity or unauthorized actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86803. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart