PT-2026-4588 · WordPress · Administrative Shortcodes

Djaidja Moundjid · Published 2026-01-24 · Updated 2026-01-24 · CVE-2026-1257

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress Administrative Shortcodes plugin versions prior to 0.3.5

Description The Administrative Shortcodes plugin for WordPress is susceptible to a Local File Inclusion issue in all versions up to and including 0.3.4. This is caused by inadequate path validation of user-supplied input passed to the get template part() function through the slug attribute of the get template shortcode. Successful exploitation allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary files on the server. This can lead to bypassing access controls, obtaining sensitive data, or achieving code execution when attackers can upload and include files. The get template shortcode and its slug attribute are involved in this issue.

Recommendations Update the Administrative Shortcodes plugin to version 0.3.5 or later.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-1257

Affected Products

Administrative Shortcodes

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1257 · Security Note
• https://twitter.com/CVEnew/status/2014995795918172661 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/119fe499-88c4-413f-a44a-2b3acfdbdeb5?source=cve · Note
• https://plugins.trac.wordpress.org/browser/administrative-shortcodes/tags/0.3.4/administrative-shortcodes.php#L144 · Note
• https://twitter.com/VulmonFeeds/status/2014985986363543643 · Twitter Post
• https://t.me/CVEtracker/42929 · Telegram Post
• https://plugins.trac.wordpress.org/browser/administrative-shortcodes/trunk/administrative-shortcodes.php#L144 · Note
• https://wordpress.org/plugins/administrative-shortcodes · Note