CVE-2026-3424 describes a code injection vulnerability in the kk Star Ratings – Rate Post & Collect User Feedbacks WordPress plugin. The flaw arises because the plugin does not properly validate the 'payload' parameter before passing it to the WordPress do_shortcode function. This improper control of code generation (CWE-94) enables unauthenticated attackers to execute arbitrary shortcodes, potentially allowing them to perform unauthorized actions within the WordPress environment. The vulnerability affects all versions up to and including 5.4.10.3. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can execute arbitrary shortcodes via the vulnerable plugin, which may lead to unauthorized actions or code execution within the WordPress site context. The CVSS score of 5.3 reflects a medium impact primarily on integrity, with no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the vulnerable plugin to prevent exploitation. Avoid exposing the vulnerable functionality to unauthenticated users.