What is the CVSS score of CVE-2026-86803?

CVE-2026-86803 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Ocean Extra CVE-2026-86803

EUVD-2026-101839 MEDIUM

Code Injection (CWE-94)

2026-10-15 Wordfence

GHSA-p2wh-5jr9-79p4

WordPress RCE Code Injection Ocean Extra Oceanwp Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach vulnerable Ocean Extra action remotely
Exploit

Submit unvalidated shortcode payload
Execution

Server executes arbitrary shortcode via do_shortcode
Impact

Disclose data or alter output

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the vulnerable Ocean Extra action/endpoint be reachable (the plugin active on the target WordPress site, versions ≤2.6.0) and that attacker input reach do_shortcode without validation; actual impact is bounded by which shortcodes are registered on the site, since only registered shortcodes will execute. Per the CVSS vector (PR:N/UI:N), no authentication and no user interaction are required, and the attack is over the network against a default installation, so the primary limiting factors are the plugin being installed/active and the set of available shortcodes determining how useful execution is - not any special non-default configuration.
Impact	This is a genuine but moderate-priority issue rather than a critical emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which normally elevates urgency, but the impact metrics are deliberately constrained to C:L/I:L/A:N - partial confidentiality and integrity impact with no availability impact - capping the base score at 6.5 (Medium). The vulnerability is arbitrary shortcode execution (CWE-94) via an action that fails to validate input before calling do_shortcode, so real-world impact depends heavily on which shortcodes are registered on the target site rather than guaranteeing full code execution. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or probable exploitation; the 'RCE' tag overstates the confirmed impact, which the CVSS low/low metrics do not support. No SSVC decision data was supplied. Net: treat as a patch-soon web vulnerability - unauthenticated and network-reachable (raising scan/mass-exploitation potential for a popular plugin), but the limited, shortcode-dependent impact and absence of any exploitation evidence argue against treating it as a drop-everything incident.
Exploit ScenarioDerived	An unauthenticated attacker sends a crafted request to the vulnerable Ocean Extra action, supplying attacker-controlled content that is passed unvalidated into do_shortcode, causing arbitrary WordPress shortcodes to be executed in the site context. Depending on which shortcodes are registered by the theme and other plugins, this could expose data or alter rendered output (consistent with the C:L/I:L impact). No public exploit code was identified at time of analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 15, 2026

Unauthenticated shortcode injection in the Ocean Extra plugin for WordPress (all versions up to and including 2.6.0) lets remote attackers pass attacker-controlled values into the WordPress do_shortcode() function without proper validation, causing arbitrary registered shortcodes to execute. Per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, score 6.5), no authentication and no user interaction are required, but real-world impact is bounded by which shortcodes are actually registered on the target site; the practical severity is therefore moderate rather than critical, and no public exploit code or confirmed active exploitation was identified at time of analysis. Note that the OceanWP/Ocean Extra vendor advisory and an upstream code changeset are the primary available intelligence, and no vendor-released fixed version number is independently confirmed.

RemediationAI

The primary fix is to move off the vulnerable code: the referenced upstream changeset (https://plugins.trac.wordpress.org/changeset/3689650/ocean-extra/trunk/includes/panel/library-shortcode.php) modifies the library-shortcode handling to correct the missing validation, so this is an upstream fix available (PR/commit); a released patched version number is not independently confirmed from the available data, meaning administrators should check the WordPress.org plugin page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/3863cc3a-7532-4925-9b59-909cfd45501a?source=cve) for a version newer than 2.6.0 and update as soon as one appears, or backport the changeset's validation to library-shortcode.php if they maintain a pinned/forked copy. If no fixed release is yet installable, deactivate Ocean Extra on internet-facing sites - the trade-off is that OceanWP's companion widgets, custom post types, metaboxes and bundled shortcodes stop functioning, which may visibly degrade the theme layout. A narrower compensating control is to restrict exposure of the plugin's shortcode-rendering action at the edge (WAF/webserver rule blocking POST/PUT requests carrying shortcode payloads to that action) and to disable unused plugins whose shortcodes add dangerous callbacks, since the achievable impact is limited to shortcodes actually registered on the site; these are partial mitigations only and can be bypassed through request encoding and parameter-name variation, so they should not substitute for patching. Because the vector is PR:N/UI:N, IP-allowlisting or authentication cannot be assumed to reduce exposure without first confirming where the endpoint is reachable, and the impact of successful exploitation should be assessed per-site based on the shortcode registry.

Affected VersionsENISA

Ocean Extra 0 ≤2.6.0

Affected Packages

euvd ocean_extra no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection) in the WordPress plugin Ocean Extra, identified by CPE cpe:2.3:a:oceanwp:ocean_extra:*:*:*:*:*:*:*:* (wildcard version, i.e. the entire affected line). WordPress's shortcode API is a text-substitution mechanism: content is stored with bracketed tags such as [gallery], and the function do_shortcode() parses that content, looks up each tag in the global $shortcode_tags registry, and invokes the matching callback. Because shortcode callbacks are ordinary PHP functions with their own capabilities and side effects - and because many plugins (including Ocean Extra and WooCommerce-style add-ons) register shortcodes that render admin-only data or accept attributes that reach internal functions - calling do_shortcode() on unvalidated, attacker-supplied input effectively turns the shortcode registry into a remotely callable function surface. In this case the vulnerable path is the plugin's library-shortcode handling (includes/panel/library-shortcode.php, touched by upstream changeset 3689650), where a user-supplied value reaches do_shortcode() without an allowlist or sanitization. The critical nuance, and the reason the assessed confidentiality and integrity impacts are Low rather than High, is that only shortcodes already registered in that WordPress installation will execute; the attacker cannot invent new callbacks, so exploitability is a function of the installed theme/plugin mix, not of a universally available primitive.

Know when Ocean Extra gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI 6.5 MEDIUM

Unauthenticated network-reachable action with no user interaction (AV:N/AC:L/PR:N/UI:N); impact limited to partial confidentiality/integrity via shortcode execution (C:L/I:L), with no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

DescriptionCVE.org

The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Threat Intelligence Overview

EPSS Score

0.2%

Top 88% exploitable

Prevalence

High

Ocean Extra is the companion plugin for the widely deployed OceanWP WordPress theme

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.