Local File Inclusion Vulnerability in Elegance Menu Plugin for WordPress

CVE-2025-11704

What is CVE-2025-11704?

The Elegance Menu plugin for WordPress contains a Local File Inclusion vulnerability that affects all versions up to and including 1.9. An authenticated attacker with Contributor-level access can exploit the 'elegance-menu' attribute of the 'elegance-menu' shortcode to include and execute arbitrary PHP files on the server. This vulnerability allows the execution of PHP code from the included files, potentially enabling the attacker to bypass access controls, extract sensitive information, and achieve unauthorized code execution.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References