CVE-2026-105322 — Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form
The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send a…
Published: 2026-10-07 · CVSS: 5.3 · CVSS 3.1
The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7