WP Blockade for WordPress contains a missing authorization flaw that allows any authenticated user to supply a shortcode through the 'shortcode' GET parameter. The plugin does not perform capability checks or nonce validation before passing the value to WordPress’s do_shortcode function, enabling arbitrary shortcode execution. Depending on which shortcodes are registered by other plugins on the site, an attacker could extract sensitive data, modify site content, or even elevate privileges.

All releases of the WP Blockade – Visual Page Builder plugin by Burlingtonbytes up to and including version 0.9.14 are affected. WordPress sites hosting any of these versions are vulnerable.

The CVSS score of 6.5 indicates moderate severity, and the absence of an EPSS rating means the current likelihood of exploitation is unknown. The flaw is not listed in the CISA KEV catalog. An attacker must already be authenticated with a Subscriber role or higher; once logged in, they can trigger the exploit by requesting wp‑admin/admin‑post.php?action=wp‑blockade‑shortcode‑render with a crafted shortcode value. Because many sites install plugins that expose sensitive data through shortcodes, the potential impact ranges from information disclosure to privilege escalation.