On October 14, 2026, Wordfence disclosed a vulnerability in Ocean Extra, the companion plugin of the OceanWP theme: up to version 2.6.0, an unauthenticated visitor could get arbitrary shortcodes executed (CVE-2026-86803). The patch, version 2.6.1, has been available since September 10, more than a month before the announcement. If you run an OceanWP site, here is how to check your version, assess your actual exposure and make sure there has been no abuse.
What happened
The vulnerability was discovered on June 28, 2026 by a researcher who goes by hashiramasenju333, according to the timeline in the CVE record published by Wordfence, the numbering authority (CNA) for this CVE. Wordfence notified OceanWP on September 8 at 2:56 p.m. (Paris time). Two days later, on September 10 at 11:35 a.m., Ocean Extra version 2.6.1 was released on wordpress.org with a single line in its changelog, "Potential vulnerability patched", which refers to a Wordfence report dated September 8.
Nothing more came out for five weeks. On October 14 at 6:43 p.m., Wordfence published its entry, titled "Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template". Patchstack and WPScan listed it the same day, and the CVE record and then NIST's NVD database followed on the morning of October 15. That same day, the enrichment published by CISA (Vulnrichment program) indicated exploitation "none" but an "automatable" attack, meaning one that can be automated at scale.
As of October 19, no recognized source documents any attack: not Wordfence, Patchstack or WPScan, nor CISA's KEV catalog. The German site Dr. Web, which covered the vulnerability on October 15, did not report any known attack either.
Why a patch that predates the announcement changes things
This 34-day gap is deliberate: researchers give users time to update before publishing the details. It has three practical consequences.
- Sites with automatic plugin updates turned on have been protected since September 10 or 11, without having to do anything.
- During those five weeks, the note "Potential vulnerability patched" said nothing about the severity or the lack of authentication: an administrator who sorts updates by hand had no reason to hurry. Vulnerability databases, and therefore the alerting tools that rely on them, did not yet know about the vulnerability.
- Since October 14, the situation is reversed: the public entry and the patch, viewable in the wordpress.org Subversion repository, show exactly where to look. Sites still on 2.6.0 or earlier are now the obvious targets.
Who is affected
Ocean Extra is the free plugin that adds to the OceanWP theme the "My Library" template library, per-page settings, widgets, demo import and several shortcodes. It has more than 400,000 active installations (wordpress.org). All versions up to and including 2.6.0 are affected; 2.6.1 fixes the vulnerability. The most recent version as of October 19 is 2.6.3, released on October 13.
| Item | CVE-2026-86803 |
|---|---|
| Plugin | Ocean Extra (wordpress.org, slug ocean-extra) |
| Affected versions | up to and including 2.6.0 |
| Fixed in | 2.6.1 (September 10, 2026); latest version 2.6.3 |
| Account required | None |
| Type | Arbitrary shortcode execution (CWE-94, code injection) |
| CVSS 3.1 | 6.5, medium (Wordfence, used by NVD and WPScan); 5.3 according to Patchstack |
| Exploitation | None documented as of October 19, 2026 |
| Discovered by | hashiramasenju333, through Wordfence |
The labels differ. Patchstack classifies the vulnerability as "arbitrary code execution" while giving it a low priority, and some aggregators speak of remote code execution. Wordfence's description is more precise: what gets executed is shortcodes, not PHP code chosen by the attacker. The real severity therefore depends on the shortcodes installed on your site.
Not all installations are exposed in the same way. According to the patch, only a "My Library" template created with the block editor is involved; templates built with Elementor, Beaver Builder or SiteOrigin go through a different code path. Update in any case.
One point to watch going forward: since September 23, WPScan and Wordfence have also listed a stored XSS exploitable by a contributor and fixed in 2.6.2, while Patchstack withdrew on October 1 the CVE identifier it had assigned to it (CVE-2026-94684), calling it a false positive. Going to 2.6.3 settles the question.
How the vulnerability worked
A shortcode is code in square brackets, such as , that WordPress replaces with content. It is an administrator's tool: WordPress does not interpret shortcodes written by visitors, for example in a comment. Ocean Extra provides the [oceanwp_library id="…"] shortcode, which displays a template from the "My Library" library (header, footer, reusable block).
Wordfence sums up the cause in one sentence: an action "does not properly validate a value before calling do_shortcode". The patch published in the wordpress.org repository is more telling. Up to 2.6.0, for a template created with the block editor, Ocean Extra first rendered the blocks (the do_blocks function), then ran the whole result through do_shortcode. But some blocks are dynamic: their content is generated at display time and may contain text coming from outside. The comment added in the patch cites comments as an example. A visitor who slipped a shortcode into such text saw it interpreted on the second pass, with the site's permissions.
Version 2.6.1 reverses the order: the saved template's shortcodes are processed first, then the blocks are rendered, and the result is no longer run through do_shortcode again. What an attacker can achieve depends on the shortcodes available: display content that should not be shown, trigger a function of another plugin, inject content into the page. That explains the CVSS score: low impact on confidentiality and integrity, none on availability, but no authentication or interaction required.
It is the second unauthenticated shortcode execution in Ocean Extra, after CVE-2025-3472 (version 2.4.6, April 2025, which required WooCommerce to be active), and the second vulnerability involving the oceanwp_library shortcode after a contributor XSS in August 2025 (CVE-2025-9499). See the full history of OceanWP and Ocean Extra vulnerabilities.
Indicators and checks on your site
No published advisory gives any indicator of compromise (IP address, file, user or typical request). The checks below help you measure your exposure and spot plausible traces; they are no substitute for a full diagnosis. Start with the installed version:
wp plugin list --name=ocean-extra --fields=name,version,status,update
wp plugin verify-checksums ocean-extraNext, list the library templates and the shortcodes registered on the site, to know what an attacker could have called:
wp post list --post_type=oceanwp_library --fields=ID,post_title,post_status,post_modified
wp eval 'echo implode( "\n", array_keys( $GLOBALS["shortcode_tags"] ) );'Then look for recent comments containing an opening square bracket, a possible sign of an attempt (adjust the wp_ prefix of your tables):
wp db query "SELECT comment_ID, comment_date, comment_author_IP, comment_approved, LEFT(comment_content, 120) FROM wp_comments WHERE comment_content LIKE '%[%' AND comment_date > '2026-06-01' ORDER BY comment_date DESC"Finally, the usual checks if in doubt:
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered: no unknown administrator;wp core verify-checksums: core files intact;find wp-content -name "*.php" -mtime -45: PHP files modified since early September, each of which should be accounted for;- in server logs, repeated requests to pages that display a "My Library" template, or bursts of comment submissions from the same address.
What to do now
- Update Ocean Extra to 2.6.3, the latest version as of October 19 (2.6.1 at minimum), from Dashboard → Updates or with
wp plugin update ocean-extra. - If the plugin is installed but unused, deactivate it and then delete it: its files remain attackable as long as they are on the server.
- If you cannot update right away, temporarily stop displaying "My Library" templates created with the block editor that contain dynamic blocks, and hold new comments for moderation.
- If the checks reveal abuse (unknown administrator, suspicious PHP file), change administrator passwords, renew the security keys in wp-config.php, revoke application passwords, then restore a clean backup. The guide to cleaning up a hacked WordPress site details the steps.
Reducing exposure next time
This case illustrates a common situation: the patch exists before anyone knows it is urgent. The best defense is therefore to apply security updates without waiting for the announcement. Automatic plugin updates would have protected these sites as early as September. For sites where you prefer to approve each update, vulnerability monitoring takes over at the time of disclosure, and an overview of pending updates keeps a forgotten site from falling weeks behind. Also keep roles and accounts to the strict minimum (principle of least privilege), keep tested backups, and consider a web application firewall with virtual patching to cover the interval between announcement and update.
WP Masquerade Pro can help with part of this work, without replacing it. Its vulnerability alerts compare the installed versions of wordpress.org plugins and themes, including Ocean Extra, with the public WPVulnerability.net database every day, and notify you by email. They would not have flagged anything before October 14: as long as a vulnerability has not been disclosed, no database knows about it. The admin activity log brings to light an account created or a plugin installed unexpectedly, from the moment it is activated and only for what goes through WordPress, and the integrity check only verifies core files, not those of Ocean Extra. Pending updates and vulnerable sites across all your sites show up in your member area. The plugin alerts: it does not fix anything and it is not a firewall.
Key takeaways
- CVE-2026-86803: unauthenticated shortcode execution in Ocean Extra up to 2.6.0, CVSS 6.5 according to Wordfence.
- Fixed in 2.6.1 on September 10, 2026, disclosed on October 14: sites with automatic updates were already protected.
- Only "My Library" templates created with the block editor are involved, according to the patch.
- No documented exploitation as of October 19; update to 2.6.3 and check administrators and recent files.
Sources
- CVE.org: CVE-2026-86803, Ocean Extra 2.6.0 and earlier (October 15, 2026) (external link, opens in a new tab)
- WordPress.org Plugin Trac: changeset 3689650, ocean-extra/includes/panel/library-shortcode.php (September 10, 2026) (external link, opens in a new tab)
- CVE.org: CVE-2026-94684, identifier rejected by Patchstack (October 1, 2026) (external link, opens in a new tab)
- NVD: CVE-2025-3472, Ocean Extra 2.4.6 and earlier (April 22, 2025) (external link, opens in a new tab)
Other sources consulted: further CVE records, official vendor pages, trade press articles, Wordfence, WPScan and Patchstack databases.
