CVE-2026-1257: 
WordPress vulnerability analysis and mitigation

CVE-2026-1257 is a Local File Inclusion (LFI) vulnerability in the Administrative Shortcodes plugin for WordPress, affecting all versions up to and including 0.3.4. The flaw resides in the get_template shortcode's slug attribute, which passes unsanitized user input to the get_template_part() function without adequate path validation. It was disclosed on January 24, 2026, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), assigned by Wordfence (Wordfence, NVD).

The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The vulnerable code at line 144 of administrative-shortcodes.php passes the user-supplied slug attribute directly to WordPress's get_template_part() function without sufficient path traversal or allowlist validation, enabling an attacker to specify arbitrary file paths on the server. Exploitation requires at minimum Contributor-level authentication on the WordPress site; the attacker crafts a shortcode such as [get_template slug="../../path/to/malicious"] within a post or page to trigger inclusion of an arbitrary PHP file. In environments where users can upload files (e.g., images with embedded PHP), this path can be leveraged to achieve remote code execution (Wordfence, WP Plugin Source).

Successful exploitation allows an authenticated attacker with Contributor-level access or higher to include and execute arbitrary PHP files on the server, resulting in high confidentiality, integrity, and availability impact. Attackers can read sensitive server-side files (e.g., wp-config.php containing database credentials), execute arbitrary PHP code, and potentially achieve full server compromise. In scenarios where file uploads are permitted, attackers can upload a PHP-embedded image and include it via the LFI vector to gain a web shell, enabling lateral movement within the hosting environment (Wordfence, NVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.07%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for at least Contributor-level authentication, which limits the attacker pool but does not eliminate risk on sites with open registration or compromised accounts (Wordfence, Feedly).

1. Reconnaissance: Identify WordPress sites running the Administrative Shortcodes plugin version ≤0.3.4 using tools like WPScan (wpscan --url https://target.com --enumerate p) or by checking /wp-content/plugins/administrative-shortcodes/ for the plugin's readme or version file.
2. Obtain Contributor Access: Register or compromise a Contributor-level (or higher) WordPress account on the target site, as the vulnerability requires authenticated access.
3. Identify Upload Capability: Determine whether the account can upload files (e.g., images). If so, craft a PHP web shell embedded in an image file (e.g., shell.php.jpg with <?php system($_GET['cmd']); ?>).
4. Upload Malicious File: Upload the crafted file via the WordPress media uploader and note the server path (e.g., /var/www/html/wp-content/uploads/2026/01/shell.php.jpg).
5. Craft Malicious Shortcode: Create or edit a post/page and insert a shortcode such as [get_template slug="../../uploads/2026/01/shell.php"], using path traversal to point to the uploaded file.
6. Trigger Execution: Preview or publish the post to cause the server to include and execute the malicious file, achieving remote code execution.
7. Achieve Objective: Use the resulting web shell or code execution to exfiltrate data (e.g., wp-config.php), establish persistence, or pivot to other systems (Wordfence, WP Plugin Source).

• Logs: WordPress access logs showing POST or GET requests to pages/posts containing get_template shortcode with unusual slug values containing ../ path traversal sequences; PHP error logs referencing unexpected file inclusion paths.
• File System: Presence of PHP-embedded image files in the uploads directory (e.g., files with double extensions like .php.jpg or .php.png); unexpected new PHP files in wp-content/uploads/.
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx spawning bash, curl, wget, or python).
• Network: Outbound connections from the web server to unknown external IPs, particularly following requests to pages with the get_template shortcode; unexpected DNS lookups from the web server host.

Users should update the Administrative Shortcodes plugin to a version beyond 0.3.4 that addresses the path validation flaw; check the WordPress plugin repository for the latest patched release. If an update is not immediately available, site administrators should deactivate and remove the plugin until a fix is confirmed. Additionally, restrict Contributor-level user registration and file upload permissions to reduce the attack surface, and implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences in shortcode parameters (Wordfence, WordPress Plugin).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for January 19–25, 2026, noting it as a notable LFI risk for sites with contributor-level user registration enabled (Wordfence Blog). The vulnerability was picked up by automated security feeds including RedPacket Security and several CVE aggregators shortly after disclosure, with limited broader community discussion given the relatively narrow scope of the affected plugin.