Brave WordPress Plugin CVE-2026-81571

The Brave WordPress plugin must be installed and active in a version prior to 0.8.8. A page containing a Brave form with URL-parameter pre-fill enabled must be publicly accessible (no authentication required to view it). Critically, the shortcode the attacker invokes must already be registered on the target site - installed themes or plugins are the source of exploitable shortcodes. Sites with no code-executing shortcodes face only limited impact (C:L/I:L); sites where a registered shortcode can write files, execute PHP, or exfiltrate credentials face materially higher risk. No authentication is required from the attacker. No user interaction (clicking, social engineering) is required. Exploitation is limited to sites in the WordPress ecosystem running this specific plugin.

Real-world risk is moderate and highly conditional. The CVSS 3.1 base score of 4.8 with AC:H accurately captures the key nuance: impact escalates or contracts based on which shortcodes happen to be registered on the target site. On a minimal WordPress installation with no code-executing shortcodes, the vulnerability may yield only limited information disclosure or minor content manipulation. On a richly-plugged site with shortcodes that output sensitive data (API keys, user info) or execute code, the impact approaches what the 'RCE' tag implies. EPSS data is absent from the provided input. A public PoC exists per WPScan, raising the likelihood of opportunistic scanning. No KEV listing means confirmed active exploitation is unverified. The AC:H designation is appropriate: an attacker must identify a viable shortcode registered on the specific target site, which requires site-specific reconnaissance. Overall, this is a real vulnerability warranting prompt patching but not an emergency for all WordPress operators - only those running Brave plugin alongside code-executing shortcodes face elevated risk.

An unauthenticated attacker identifies a WordPress site running the Brave plugin by probing for plugin-specific assets or form pages. They craft a URL pointing to a page hosting a Brave form, appending a query parameter whose value is a WordPress shortcode such as one that outputs sensitive configuration data or invokes a code-execution shortcode registered by another installed plugin. The server renders the page, passes the URL parameter to do_shortcode(), and returns the shortcode's output to the attacker. A public PoC from WPScan exists that demonstrates this injection path.