CVE-2026-103908

The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with custom-level access and above, to execute arbitrary shortcodes. The vulnerable output block is gated by the 'ampforwp-cat-description' setting, which is enabled by default, meaning the vast majority of installations are affected without any additional configuration change.

• CWE-94

• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.17/components/loop/loop.php#L45
• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.17/components/loop/loop.php#L69
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3743894%40accelerated-mobile-pages&new=3743894%40accelerated-mobile-pages
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fcd756ea-9690-4535-9cc4-203a10093432?source=cve

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103899The EU VAT Assistant for WooCommerce plugin for WordPress is…7.2
• CVE-2026-103902Improper verification of cryptographic signature vulnerabili…7.5
• CVE-2026-103903An incorrect authorization vulnerability in the WinBox authe…8.8
• CVE-2026-103904The public consent endpoint of JTL-Shop accepts arbitrary co…9.3
• CVE-2026-103905The authentication middleware of the JTL-Shop administration…7.5
• CVE-2026-103907The JNews - Jeg Elementor Kit plugin for WordPress is vulner…6.5
• CVE-2026-103909The Calculated Fields Form – AI Form Builder for WordPress –…6.1
• CVE-2026-103910Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-103911The The Forminator Forms – Contact Form, Payment Form & Cust…6.5
• CVE-2026-103912The JetFormBuilder — Dynamic Blocks Form Builder plugin for …4.7
• CVE-2026-103913The GeoDirectory plugin for WordPress is vulnerable to SQL I…7.5
• CVE-2026-103915The Booking for Appointments and Events Calendar – Amelia pl…5.3