kk Star Ratings CVE-2026-3424

The target WordPress site must have the kk Star Ratings - Rate Post & Collect User Feedbacks plugin installed and active in any version up to and including 5.4.10.3. No authentication is required - the vulnerable AJAX handler is explicitly registered under the wp_ajax_nopriv_ hook, making it reachable by unauthenticated HTTP requests without any session cookie or nonce. No non-default configuration is needed beyond plugin activation. The CVSS AV:N/AC:L/PR:N/UI:N metrics confirm this. The primary factor limiting exploitation severity is the shortcode ecosystem on the target site: on a minimal WordPress installation with no third-party shortcode-registering plugins, impact is low (arbitrary but benign shortcode invocation); on a plugin-rich site with shortcodes that execute PHP, query the database, or read filesystem paths, impact can escalate to data disclosure or code execution. Exploitation is limited to WordPress sites only - non-WordPress deployments are not affected.

The official CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects zero-friction unauthenticated network exploitation with a conservative integrity-only impact. The base score is plausibly an underestimate: the official C:N rating does not account for third-party shortcodes that expose data, and the threat intelligence RCE tag suggests environments with PHP-executing shortcodes could face higher impact - though this is not independently confirmed by the CVSS vector. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified precisely. The vulnerability is not in the CISA KEV catalog and no public exploit code has been identified. Despite the moderate score, the AC:L/PR:N/UI:N combination means fully automated, mass scanning for exposed admin-ajax.php endpoints with this action is trivially achievable, so any site running the vulnerable plugin version is exposed without any prerequisite targeting - a mid-sized operator running dozens of WordPress sites should treat this as an urgent patching item regardless of raw score. The RCE tag from the intelligence aggregator is not corroborated by the CVSS I:L rating and should be treated as indicative of potential rather than confirmed arbitrary code execution.

An unauthenticated attacker sends a crafted HTTP POST request to a target WordPress site's admin-ajax.php endpoint with action=kk-star-ratings and a payload parameter containing an arbitrary shortcode tag such as [php_everywhere] or a similar code-executing shortcode registered by a co-installed plugin. Because the plugin's handler invokes do_shortcode() on the unvalidated payload, the shortcode executes with WordPress's normal runtime context, potentially reading files, querying the database, or executing PHP depending on available shortcodes. The attack requires no credentials, no prior reconnaissance beyond confirming the plugin is active, and is fully automatable at scale.