Magee Shortcodes CVE-2026-105322

Exploitation requires that the vulnerable Magee Shortcodes plugin (through 2.1.1) is installed and active on a WordPress site and that a page exposes one of its contact-form shortcodes so the unauthenticated contact-form action is reachable. The core defect is that the recipient address of certain unauthenticated contact-form actions is not restricted to a server-defined value, letting the attacker control the destination. No authentication (PR:N) and no user interaction (UI:N) are needed. The main limiting factor is deployment-dependence: a site must actually render the plugin's contact form for the action endpoint to be live; sites with the plugin installed but no shortcode-bearing page are less exposed. Impact is confined to email abuse - there is no code execution or data disclosure.

This is a moderate, non-critical issue best characterized as abuse-of-functionality rather than system compromise. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) is internally consistent with the description: a remote, unauthenticated attacker over the network can trigger the flaw with low complexity and no user interaction, affecting integrity only (I:L) with no confidentiality or availability impact. The low integrity impact correctly reflects that the attacker does not alter the target system itself but abuses it as an open mail relay to send arbitrary emails. Publicly available exploit code exists (per WPScan), which raises practical reachability, but this CVE is NOT in CISA KEV, so there is no confirmed active exploitation. No EPSS score was provided in the input, so exploitation-probability cannot be quantified here. There is no SSVC decision data supplied. The dominant real-world risk is reputational/operational: the site's domain and IP can be used to send spam or phishing, leading to blocklisting and deliverability damage, not takeover of the host. Net: a genuine but medium-priority issue - prioritize patching on high-traffic or email-reputation-sensitive sites, but it is not a drop-everything critical.

An attacker identifies a WordPress site running Magee Shortcodes (≤2.1.1) and sends crafted, unauthenticated requests to the plugin's contact-form action, specifying an arbitrary recipient address and message body. A public exploit for this exists (WPScan), so the attacker can script bulk delivery, turning the site into an open relay for spam or phishing that appears to originate from the victim domain.