Description
Unauthenticated Sensitive Data Exposure in Shortcodes and extra features for Phlox theme <= 2.17.22 versions.
Published: 2026-08-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is an unauthenticated Sensitive Data Exposure flaw (CWE-201) in the WordPress plugin "Shortcodes and extra features for Phlox theme". The flaw arises from improper handling of shortcode parameters, allowing an attacker to retrieve data that should be protected. The exposure is limited to data that the plugin uses or processes; there is no indication that the flaw allows code execution or other higher‑level attacks.

Affected Systems

The affected product is the WordPress plugin "Shortcodes and extra features for Phlox theme" developed by Averta. All releases up to and including version 2.17.22 are vulnerable. WordPress sites that have any of those versions in use are at risk until the plugin is updated or removed.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated; an attacker can provoke the disclosure by sending crafted shortcode requests or loading a page that parses shortcodes. No active exploits are publicly known, and the flaw can affect any visitor who can access a page that processes the vulnerable shortcode.

Generated by OpenCVE AI on August 18, 2026 at 18:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Shortcodes and extra features for Phlox theme plugin to a release newer than 2.17.22 if one is available, or remove the plugin if it is not required.
  • Restrict shortcode execution on public pages, for example by adding a filter to allow shortcodes only for logged‑in administrators or authenticated users.
  • Implement server‑side validation or a WAF rule that blocks requests containing unexpected or malformed shortcode syntax to prevent unauthorized data exposure.

Generated by OpenCVE AI on August 18, 2026 at 18:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Averta
Averta shortcodes And Extra Features For Phlox Theme
Wordpress
Wordpress wordpress
Vendors & Products Averta
Averta shortcodes And Extra Features For Phlox Theme
Wordpress
Wordpress wordpress

Tue, 18 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated Sensitive Data Exposure in Shortcodes and extra features for Phlox theme <= 2.17.22 versions.
Title WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Sensitive Data Exposure vulnerability
Weaknesses CWE-201
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Averta Shortcodes And Extra Features For Phlox Theme
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-18T14:31:55.078Z

Reserved: 2026-08-14T10:16:11.319Z

Link: CVE-2026-74008

cve-icon Vulnrichment

Updated: 2026-08-18T14:31:49.618Z

cve-icon NVD

Status : Deferred

Published: 2026-08-18T15:17:09.437

Modified: 2026-08-20T12:48:31.843

Link: CVE-2026-74008

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T18:45:03Z

Weaknesses
  • CWE-201

    Insertion of Sensitive Information Into Sent Data