Local File Inclusion Vulnerability in Elegance Menu Plugin for WordPress

CVE-2025-11704

What is CVE-2025-11704?

The Elegance Menu plugin for WordPress contains a Local File Inclusion vulnerability that affects all versions up to and including 1.9. An authenticated attacker with Contributor-level access can exploit the 'elegance-menu' attribute of the 'elegance-menu' shortcode to include and execute arbitrary PHP files on the server. This vulnerability allows the execution of PHP code from the included files, potentially enabling the attacker to bypass access controls, extract sensitive information, and achieve unauthorized code execution.

References