CVE-2026-3424: CWE-94 Improper Control of Generation of Code ('Code Injection') in properfraction kk Star Ratings – Rate Post & Collect User Feedbacks

CVE-2026-3424 describes a vulnerability in the kk Star Ratings – Rate Post & Collect User Feedbacks WordPress plugin where the software fails to properly validate the 'payload' parameter before passing it to the do_shortcode function. This flaw allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to code injection scenarios. The vulnerability affects all versions from 0 up to and including 5.4.10.3. The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity loss without confidentiality or availability impact. No known exploits are reported in the wild, and no official patch or vendor advisory is provided in the input data.

An unauthenticated attacker can execute arbitrary shortcodes within the vulnerable WordPress plugin, potentially leading to unauthorized code execution or manipulation of plugin behavior. The CVSS score indicates a medium severity impact primarily affecting integrity. There is no reported impact on confidentiality or availability. No known active exploitation is documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin's functionality or disabling it if possible to mitigate risk. Monitor for vendor updates or security advisories regarding this vulnerability.