CVE-2026-81571
Received Received - Intake

Brave WordPress Plugin Shortcode Injection

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-81571
EUVD
EUVD-2026-70044

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
brave wordpress_plugin to 0.8.8 (exc)
brave popup_builder to 0.8.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Brave WordPress plugin before version 0.8.8 has a flaw where a URL parameter used to pre-fill a form field is not properly sanitized. This allows unauthenticated attackers to pass the parameter to WordPress's shortcode engine, executing arbitrary server-side shortcodes registered on the site.

Detection Guidance

Check if the Brave WordPress plugin version is below 0.8.8. Inspect network traffic for UTM parameters passed to WordPress shortcode endpoints. Look for unusual shortcode execution logs in server logs.

Impact Analysis

An attacker could exploit this to run malicious server-side code, potentially stealing data, defacing the site, or installing backdoors. The attack requires a popup with a hidden form field set to take a default value from a URL parameter.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR or HIPAA requirements for data protection and integrity. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Update the Brave WordPress plugin to version 0.8.8 or later immediately. Disable any popups with hidden form fields using URL parameters until updated. Monitor server logs for suspicious shortcode execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81571. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart