CVE-2026-105322
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).
Risk Assessment
Attackers can use the site as a relay for spam or phishing, potentially harming domain reputation and causing email deliverability issues.
Recommendation
Update the Magee Shortcodes plugin to a version that includes a fix restricting form recipients.
Other vulnerabilities in Magee Shortcodes
Original NVD description (English source)
The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS