CVE-2026-3480 is a missing authorization vulnerability (CWE-862) in the WP Blockade – Visual Page Builder plugin for WordPress. The vulnerability arises because the plugin registers an admin_post action hook 'wp-blockade-shortcode-render' mapped to the render_shortcode_preview() function, which lacks any current_user_can() capability checks or nonce verification. This allows any authenticated user, including those with Subscriber-level privileges, to supply a 'shortcode' parameter via GET that is executed directly by do_shortcode() after stripslashes(), enabling execution of arbitrary shortcodes. The impact depends on the shortcodes registered on the site and could include information disclosure or privilege escalation.

Authenticated users with low privileges (Subscriber and above) can execute arbitrary WordPress shortcodes due to missing authorization checks. This could lead to unauthorized information disclosure or privilege escalation depending on the shortcodes available on the site. The vulnerability does not directly affect availability or integrity but poses a confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict plugin usage to trusted users only or disable the vulnerable shortcode rendering functionality if possible. Monitor for updates from the plugin vendor and apply official fixes once released.