CVE-2026-1257

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1257", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-20T19:59:34.956Z", "datePublished": "2026-01-24T07:26:39.850Z", "dateUpdated": "2026-04-08T16:36:15.775Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:15.775Z"}, "affected": [{"vendor": "shazdeh", "product": "Administrative Shortcodes", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.3.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the 'slug' attribute of the 'get_template' shortcode. This is due to insufficient path validation on user-supplied input passed to the get_template_part() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \"safe\" file types can be uploaded and included."}], "title": "Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/119fe499-88c4-413f-a44a-2b3acfdbdeb5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/administrative-shortcodes/trunk/administrative-shortcodes.php#L144"}, {"url": "https://wordpress.org/plugins/administrative-shortcodes"}, {"url": "https://plugins.trac.wordpress.org/browser/administrative-shortcodes/tags/0.3.4/administrative-shortcodes.php#L144"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2026-01-23T19:21:03.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T15:30:21.356369Z", "id": "CVE-2026-1257", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T15:45:54.702Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1257", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-26T15:30:21.356369Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T15:30:22.367Z"}}], "cna": {"title": "Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "shazdeh", "product": "Administrative Shortcodes", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.3.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-23T19:21:03.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/119fe499-88c4-413f-a44a-2b3acfdbdeb5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/administrative-shortcodes/trunk/administrative-shortcodes.php#L144"}, {"url": "https://wordpress.org/plugins/administrative-shortcodes"}, {"url": "https://plugins.trac.wordpress.org/browser/administrative-shortcodes/tags/0.3.4/administrative-shortcodes.php#L144"}], "descriptions": [{"lang": "en", "value": "The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the 'slug' attribute of the 'get_template' shortcode. This is due to insufficient path validation on user-supplied input passed to the get_template_part() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \"safe\" file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:15.775Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1257", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:36:15.775Z", "dateReserved": "2026-01-20T19:59:34.956Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-24T07:26:39.850Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Administrative Shortcodes", "vendor": "shazdeh", "versions": [{"lessThanOrEqual": "0.3.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the 'slug' attribute of the 'get_template' shortcode. This is due to insufficient path validation on user-supplied input passed to the get_template_part() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \"safe\" file types can be uploaded and included."}, {"lang": "es", "value": "El plugin Administrative Shortcodes para WordPress es vulnerable a la inclusi\u00f3n local de ficheros en todas las versiones hasta la 0.3.4, inclusive, a trav\u00e9s del atributo 'slug' del shortcode 'get_template'. Esto se debe a una validaci\u00f3n de ruta insuficiente en la entrada proporcionada por el usuario pasada a la funci\u00f3n get_template_part(). Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, incluyan y ejecuten ficheros arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros. Esto puede usarse para eludir los controles de acceso, obtener datos sensibles o lograr la ejecuci\u00f3n de c\u00f3digo en casos donde im\u00e1genes y otros tipos de ficheros 'seguros' pueden ser subidos e incluidos."}], "id": "CVE-2026-1257", "lastModified": "2026-06-17T10:15:24.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1257", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T15:30:21.356369Z", "version": "2.0.3"}}]}, "published": "2026-01-24T08:16:09.517", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/administrative-shortcodes/tags/0.3.4/administrative-shortcodes.php#L144"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/administrative-shortcodes/trunk/administrative-shortcodes.php#L144"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/administrative-shortcodes"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/119fe499-88c4-413f-a44a-2b3acfdbdeb5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T21:41:32.924368+00:00", "value": {"mitigation_remediation": ["Upgrade the Administrative Shortcodes plugin to the latest available version (0.3.5 or newer).", "Disable or remove the get_template shortcode from content, or restrict its use to administrators only.", "Ensure that the WordPress upload directory and other directories from which files may be uploaded do not allow PHP execution, and validate all file paths before inclusion."], "summary": {"action": "Patch immediately", "impact": "Remote code execution via local file inclusion"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Administrative Shortcodes plugin up to and including version 0.3.4 are affected. The plugin is most commonly found on public forums, community sites, or any WordPress installation that has installed Administrative Shortcodes and allows Contributor or higher roles to create or edit content containing shortcodes.", "description_and_impact": "The vulnerability in Administrative Shortcodes allows authenticated users with Contributor-level permissions to supply a crafted \u2018slug\u2019 value to the get_template shortcode, which is passed unchecked to WordPress\u2019s get_template_part() function. This lack of path validation lets the attacker include and execute arbitrary files on the server, including potentially user\u2011generated PHP files, enabling code execution, data theft, or escalation of privileges.", "risk_and_exploitability": "The CVSS score of 7.5 indicates high severity. The EPSS score is less than 1\u202f% and the vulnerability is not listed in the KEV catalog, suggesting low current exploitation probability, though the attack requires an authenticated Contributor or higher. Exploitation would involve uploading a specially crafted file or inserting a malicious \u2018slug\u2019 parameter into a page that is rendered with the get_template shortcode. If successful, the attacker could achieve full remote code execution on the site server."}}}}, "created": "2026-01-26T11:48:16.913486+00:00", "updated": "2026-04-15T21:45:14.151785+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}