CVE-2026-103908

Name of the Vulnerable Software and Affected Versions AMP for WP – Accelerated Mobile Pages versions prior to 1.1.19

Description Authenticated attackers with custom-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the do shortcode() function. The issue is linked to the ampforwp-cat-description setting, which is enabled by default.

Recommendations Update to a version newer than 1.1.18. Disable the ampforwp-cat-description setting to mitigate the risk.