Local File Inclusion in Administrative Shortcodes Plugin for WordPress

CVE-2026-1257

What is CVE-2026-1257?

The Administrative Shortcodes plugin for WordPress is susceptible to a Local File Inclusion vulnerability due to inadequate path validation on user-supplied input in the 'get_template' shortcode's 'slug' attribute. This flaw affects all versions up to and including 0.3.4 and allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary files on the server. This can lead to unauthorized execution of PHP code, potential access control bypass, and exposure of sensitive data as attackers may exploit this vulnerability to upload and include harmful files disguised as safe types like images.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References