CVE-2026-1257

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the 'slug' attribute of the 'get_template' shortcode. This is due to insufficient path validation on user-supplied input passed to the get_template_part() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-98

Affected software

Vendor	Product	Versions
shazdeh	Administrative Shortcodes	<= 0.3.4

References

Timeline

Published: Jan 24, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-125705.5A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files CVE-2026-1257036.5A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-CVE-2026-1257047.5A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, a CVE-2026-1257066.5A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not CVE-2026-1257077.1A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-by CVE-2026-1257086.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons CVE-2026-1257094.2A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data in CVE-2026-125719.8An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.CVE-2026-1257113.5The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking CVE-2026-1257127.5A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a CVE-2026-1257155.3Samsung mTower lacks access control for TA sessions, allowing a Normal World application to open TA sessions and invoke their commands, or u CVE-2026-125727.2Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to c