CVE-2026-3480: CWE-862 Missing Authorization in burlingtonbytes WP Blockade – Visual Page Builder
The WP Blockade plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 0.9.14. The plugin registers an admin_post action hook 'wp-blockade-shortcode-render' that maps to the render_shortcode_preview() function. This function lacks any capability check (current_user_can()) and nonce verification, allowing any authenticated user to execute arbitrary WordPress shortcodes. The function takes a user-supplied 'shortcode' parameter from $_GET, passes it through stripslashes(), and directly executes it via do_shortcode(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes, which could lead to information disclosure, privilege escalation, or other impacts depending on what shortcodes are registered on the site (e.g., shortcodes from other plugins that display sensitive data, perform actions, or include files).
AI Analysis
Technical Summary
CVE-2026-3480 describes a missing authorization vulnerability (CWE-862) in the WP Blockade – Visual Page Builder plugin for WordPress, affecting all versions up to 0.9.14. The plugin registers an admin_post action hook 'wp-blockade-shortcode-render' linked to the render_shortcode_preview() function, which lacks any current_user_can() capability checks or nonce verification. This allows any authenticated user, including those with Subscriber-level privileges, to supply a 'shortcode' parameter via GET, which is then executed directly using do_shortcode(). The impact depends on the shortcodes registered on the site, potentially enabling information disclosure or privilege escalation.
Potential Impact
Authenticated users with low privileges (Subscriber-level) can execute arbitrary WordPress shortcodes due to missing authorization checks. This may lead to unauthorized information disclosure or privilege escalation depending on the shortcodes available on the site. The vulnerability does not affect unauthenticated users and does not impact availability or integrity directly.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only or disable the vulnerable shortcode rendering functionality if possible. Monitor for updates from the vendor regarding patches or official mitigations.
CVE-2026-3480: CWE-862 Missing Authorization in burlingtonbytes WP Blockade – Visual Page Builder
Description
The WP Blockade plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 0.9.14. The plugin registers an admin_post action hook 'wp-blockade-shortcode-render' that maps to the render_shortcode_preview() function. This function lacks any capability check (current_user_can()) and nonce verification, allowing any authenticated user to execute arbitrary WordPress shortcodes. The function takes a user-supplied 'shortcode' parameter from $_GET, passes it through stripslashes(), and directly executes it via do_shortcode(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes, which could lead to information disclosure, privilege escalation, or other impacts depending on what shortcodes are registered on the site (e.g., shortcodes from other plugins that display sensitive data, perform actions, or include files).
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-3480 describes a missing authorization vulnerability (CWE-862) in the WP Blockade – Visual Page Builder plugin for WordPress, affecting all versions up to 0.9.14. The plugin registers an admin_post action hook 'wp-blockade-shortcode-render' linked to the render_shortcode_preview() function, which lacks any current_user_can() capability checks or nonce verification. This allows any authenticated user, including those with Subscriber-level privileges, to supply a 'shortcode' parameter via GET, which is then executed directly using do_shortcode(). The impact depends on the shortcodes registered on the site, potentially enabling information disclosure or privilege escalation.
Potential Impact
Authenticated users with low privileges (Subscriber-level) can execute arbitrary WordPress shortcodes due to missing authorization checks. This may lead to unauthorized information disclosure or privilege escalation depending on the shortcodes available on the site. The vulnerability does not affect unauthenticated users and does not impact availability or integrity directly.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only or disable the vulnerable shortcode rendering functionality if possible. Monitor for updates from the vendor regarding patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-03-03T14:43:17.464Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d5fe4c1cc7ad14da373844
Added to database: 4/8/2026, 7:05:48 AM
Last enriched: 4/8/2026, 7:22:02 AM
Last updated: 4/9/2026, 8:04:22 AM
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.