GTranslate CVE-2026-86604

Exploitation requires the GTranslate plugin (before 5.0.1) to be configured in a NON-DEFAULT way that causes user-influenced content to be included in outgoing emails whose body is passed through WordPress shortcode expansion. It further requires that a shortcode useful to the attacker is already registered on the site, since only registered shortcodes execute - this is the primary limiting factor and the reason for AC:H. No authentication or user interaction is needed (PR:N/UI:N), and the vector is remote (AV:N). Default installations are NOT vulnerable; realistic impact is bounded by the capabilities of the registered shortcodes present.

This is a real but low-priority issue. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, score 4.8) is internally consistent with the description: network-reachable (AV:N), no authentication (PR:N), but high complexity (AC:H) because exploitation only works 'in a non-default configuration' AND depends on which shortcodes happen to be registered on the target site. Impact is capped at C:L/I:L/A:N - despite the 'RCE' tag in the input, the description describes server-side execution of *already-registered* shortcodes, not arbitrary code execution; actual severity depends entirely on whether a dangerous shortcode is present, so the RCE label overstates the confirmed impact. A public exploit exists (WPScan), which raises accessibility, but POC availability is NOT the same as active exploitation. No EPSS score, no CISA KEV listing, and no evidence of in-the-wild use were provided. Net: publicly available exploit code exists against an unauthenticated network vector, but the AC:H gating (non-default config + attacker-relevant registered shortcode) makes this a targeted, opportunistic issue rather than a mass-exploitable one - patch on a normal cadence.

On a site running GTranslate before 5.0.1 with the relevant non-default email configuration enabled, an unauthenticated attacker submits content (e.g., via a form or field that feeds an outgoing email) containing a WordPress shortcode. When the plugin generates the outgoing email it expands the shortcode without stripping it, executing whatever that registered shortcode does server-side. A public proof-of-concept is available via WPScan, but success requires the non-default config plus a shortcode registered on the site whose behavior benefits the attacker (reflected by AC:H).