PT-2026-43540 · WordPress · Query Shortcode

Dj + 1 · Published 2026-05-27 · Updated 2026-06-04 · CVE-2026-9200

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Query Shortcode versions prior to 0.2.2

Description The Query Shortcode plugin for WordPress contains a Local File Inclusion issue within the shortcode function. Authenticated attackers with contributor-level access or higher can exploit this by using the lens shortcode attribute to include and execute arbitrary .php files on the server. This allows for the execution of PHP code, which can be used to bypass access controls or obtain sensitive data, particularly when .php files can be uploaded to the server.

Recommendations Update the plugin to a version later than 0.2.1.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-9200

Affected Products

Query Shortcode

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-9200 · Security Note
• https://t.me/CVEtracker/55072 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/28df760b-6b15-41ca-b93f-9d24dbbd9fc4?source=cve · Note
• https://reddit.com/r/StopBadBots/comments/1twww49/insane_record_145_wordpress_plugins_exposed_with · Reddit Post
• https://plugins.trac.wordpress.org/browser/query-shortcode/trunk/init.php#L56 · Note
• https://plugins.trac.wordpress.org/browser/query-shortcode/trunk/init.php#L178 · Note
• https://plugins.trac.wordpress.org/browser/query-shortcode/trunk/init.php#L97 · Note
• https://twitter.com/DFIR_Lab/status/2061247716349407381 · Twitter Post