CVE-2026-1257
Published: 24 January 2026
Summary
CVE-2026-1257 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-1257 is a Local File Inclusion (LFI) vulnerability in the Administrative Shortcodes plugin for WordPress, affecting all versions up to and including 0.3.4. The issue arises from insufficient path validation on user-supplied input passed through the 'slug' attribute of the 'get_template' shortcode to the get_template_part() function, as identified under CWE-98. Published on 2026-01-24, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability over the network. By crafting a malicious 'slug' value, they can include and execute arbitrary files on the server, leading to PHP code execution within those files. This capability allows bypassing access controls, obtaining sensitive data, or achieving code execution, particularly when images or other "safe" file types containing PHP payloads can be uploaded and included.
Advisories reference the vulnerable code at line 144 in administrative-shortcodes.php for both the 0.3.4 tag and trunk versions on the WordPress plugins Trac, the plugin's WordPress.org page, and a Wordfence threat intelligence report detailing the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4557
Vulnerability details
The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the 'slug' attribute of the 'get_template' shortcode. This is due to insufficient path validation on user-supplied input passed to…
more
the get_template_part() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress plugin directly enables exploitation for RCE via arbitrary file inclusion and web shell deployment.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the insufficient path validation on the user-supplied 'slug' attribute passed to get_template_part(), preventing arbitrary file inclusion and PHP code execution.
Requires identification, reporting, and correction of the LFI flaw in the Administrative Shortcodes plugin up to version 0.3.4, eliminating the vulnerability through timely patching.
Enforces least privilege to restrict Contributor-level access or higher, limiting the authenticated users able to exploit the vulnerable shortcode.