CVE-2026-86803: Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Ocean Extra for WordPress is affected in all versions up to and including 2.6.0. The issue is associated with the oceanwp_library shortcode template.
Does exploitation require an account or user interaction?
No. The vulnerability is described as unauthenticated, with no privileges or user interaction required; it can be exploited remotely over the network.
What can an attacker do?
An attacker can execute arbitrary WordPress shortcodes because a value is not properly validated before it is passed to do_shortcode. The reported impact includes low confidentiality and integrity impact, with no availability impact.