CVE-2026-1988
Published: 14 February 2026
Summary
CVE-2026-1988 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Mitre (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-1988 is a Local File Inclusion (LFI) vulnerability in the Flexi Product Slider and Grid for WooCommerce plugin for WordPress, affecting all versions up to and including 1.0.5. The issue arises in the `flexipsg_carousel` shortcode, where the `theme` parameter is directly concatenated into a file path without proper sanitization or validation, enabling directory traversal as described by CWE-98. Published on 2026-02-14, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability by creating posts that include the shortcode with a manipulated `theme` parameter. This allows them to include and execute arbitrary PHP files on the server, potentially leading to remote code execution.
References include the CWE definitions for PHP file inclusion (CWE-98) and path traversal (CWE-22), as well as source code locations in the plugin at line 82 of includes/class-flexipsg-shortcode.php in both the 1.0.5 tag and trunk versions on the WordPress plugin trac. Additional details are available in the Wordfence threat intelligence report.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6040
Vulnerability details
The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the `flexipsg_carousel` shortcode. This is due to the `theme` parameter being directly concatenated into…
more
a file path without proper sanitization or validation, allowing directory traversal. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server via the `theme` parameter granted they can create posts with shortcodes.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress plugin directly enables T1190 exploitation leading to RCE via arbitrary PHP file inclusion, which facilitates T1505.003 web shell deployment/execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the lack of sanitization and validation of the 'theme' parameter in the flexipsg_carousel shortcode, preventing directory traversal and local file inclusion.
Mandates timely identification, reporting, and patching of the LFI flaw in Flexi Product Slider and Grid for WooCommerce plugin versions up to 1.0.5.
Enforces least privilege to restrict Contributor-level and higher users from creating posts with shortcodes containing malicious 'theme' parameters.