Atomic Edge analysis of CVE-2026-24564:
The vulnerability is an authenticated arbitrary shortcode execution flaw in the Textmetrics WordPress plugin. The affected component is the plugin’s AJAX request handler. Attackers with Subscriber-level access or higher can execute arbitrary WordPress shortcodes, leading to privilege escalation or other security impacts.

Atomic Edge research identifies the root cause in the file `webtexttool/core/class-webtexttool-core.php`. The vulnerable function `get_webtexttoolnonce_action` (implied by the context) processes AJAX requests. Before the patch, the function at line 735 began processing the `$_POST[‘data’]` parameter without verifying the user’s capability to execute shortcodes. The code path allowed any authenticated user to reach the `do_shortcode` call on unsanitized user input.

Exploitation requires an authenticated attacker with at least Subscriber privileges. The attack vector is a POST request to `/wp-admin/admin-ajax.php`. The attacker must supply the parameters `nonce`, `data`, and `postId`. The `action` parameter must be set to the specific hook handled by the vulnerable Textmetrics function. The payload is placed in the `data` parameter, which contains the arbitrary shortcode to be executed by `do_shortcode`.

The patch adds a capability check before processing the AJAX request. In `webtexttool/core/class-webtexttool-core.php`, at line 738, the code now includes `if (!current_user_can(‘edit_posts’)) { exit; }`. This change restricts access to users with the `edit_posts` capability, typically assigned to Contributor roles and above. The patch prevents Subscriber and Customer roles from reaching the shortcode execution logic. The plugin version was also updated from 3.6.3 to 3.6.4.

Successful exploitation allows execution of any shortcode available on the WordPress site. This can lead to information disclosure, privilege escalation, or remote code execution, depending on the shortcodes installed. For example, a shortcode from another plugin could be used to read sensitive data, create administrative users, or execute PHP code.