CVE-2026-103908: AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info
The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for authenticated attackers, with custom-level access and above, to execute arbitrary shortcodes. The vulnerable output block is gated by the 'ampforwp-cat-description' setting, which is enabled by default, meaning the vast majority of installations are affected without any additional configuration change.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress with Subscriber-level access or higher, described as custom-level access and above. No user interaction is required.
Are default AMP for WP installations affected?
Yes. The vulnerable output block is controlled by the ampforwp-cat-description setting, which is enabled by default, so most installations are affected without configuration changes.
What can an attacker do with successful exploitation?
A qualifying authenticated user can execute arbitrary shortcodes through the affected author biographical information handling. The reported impact includes low confidentiality and low integrity impact, with no availability impact.