Local File Inclusion Vulnerability in Query Shortcode Plugin for WordPress

CVE-2026-9200

What is CVE-2026-9200?

The Query Shortcode plugin for WordPress has a Local File Inclusion issue that affects all versions up to 0.2.1. This vulnerability permits authenticated users with contributor-level access and above to exploit the shortcode function. By including arbitrary .php files from the server, attackers can execute potentially malicious PHP code. This can lead to unauthorized access, data breaches, or arbitrary code execution, especially in scenarios where .php files can be uploaded and included. It is critical for users of affected versions to assess their risk and consider applying security patches or updates.

References