CVE-2026-86604: GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation
The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GTranslate WordPress pluginto a version that resolves this vulnerability.Fixed in 5.0.1
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using a GTranslate version earlier than 5.0.1 are affected only when configured to translate outgoing email content. This is a non-default configuration.
What does an attacker need to exploit it?
No authentication or user interaction is required, but the attacker must be able to cause content containing a shortcode to be included in an outgoing translated email. Exploitation also depends on relevant shortcodes being registered on the site.
What is the practical impact?
An attacker may cause arbitrary shortcodes registered by the site to execute server-side through outgoing email translation. The stated impact includes limited confidentiality and integrity effects, with no availability impact.
How can I determine whether immediate mitigation is needed?
Check whether GTranslate is below version 5.0.1 and whether outgoing email translation has been enabled. If both conditions apply, review the site’s registered shortcodes and paths by which unauthenticated users can influence content sent in outgoing emails.