CVE-2026-1988: 
WordPress vulnerability analysis and mitigation

CVE-2026-1988 is a Local File Inclusion (LFI) vulnerability in the Flexi Product Slider and Grid for WooCommerce WordPress plugin (by odude/wpdecent), affecting all versions up to and including 1.0.5. The flaw exists in the flexipsg_carousel shortcode, where the theme parameter is directly concatenated into a file path without sanitization, enabling directory traversal and arbitrary PHP file inclusion. It was published on February 14, 2026, with a CVSS v3.1 base score of 7.5 (High) (Feedly, Red Hat CVE).

The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program — 'PHP Remote File Inclusion'), with an underlying path traversal component (CWE-22). The theme parameter passed to the flexipsg_carousel shortcode is concatenated directly into a PHP file path without sanitization or validation, allowing an attacker to inject ../ sequences to traverse directories and include arbitrary PHP files on the server (Feedly, CWE-98). Exploitation requires the attacker to have at least Contributor-level WordPress authentication and the ability to create posts containing shortcodes. Once a malicious file is included, PHP will parse and execute any embedded code within it (CWE-98).

Successful exploitation allows an authenticated attacker (Contributor or above) to include and execute arbitrary PHP files on the web server, resulting in full compromise of confidentiality, integrity, and availability of the affected WordPress installation. An attacker could read sensitive server files, execute system commands, deploy web shells, exfiltrate data, or pivot to other systems accessible from the server (Feedly, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the time of this report. The vulnerability requires Contributor-level authentication, which raises the exploitation bar compared to unauthenticated flaws. The EPSS score is 0.00138 (approximately 0.14%), indicating a low current probability of exploitation in the wild (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified.

1. Reconnaissance: Identify WordPress sites running the Flexi Product Slider and Grid for WooCommerce plugin version ≤ 1.0.5 using tools like WPScan or by inspecting plugin directories/readme files.
2. Obtain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges (e.g., via credential stuffing, phishing, or open registration).
3. Stage a Malicious PHP File: Upload or identify a file on the server containing PHP code (e.g., a previously uploaded image with embedded PHP, or a log file with injected PHP via log poisoning).
4. Craft Malicious Shortcode: Create or edit a post/page containing the flexipsg_carousel shortcode with a crafted theme parameter using directory traversal sequences, e.g., [flexipsg_carousel theme="../../../../path/to/malicious"].
5. Trigger Execution: Publish or preview the post to cause the server to include and execute the targeted PHP file, achieving remote code execution on the server (Feedly, CWE-98).

• Logs: WordPress access logs showing POST or GET requests to pages/posts containing flexipsg_carousel shortcode with theme parameters containing ../ sequences or unusual path strings; PHP error logs referencing unexpected file inclusion paths.
• File System: Presence of unexpected PHP files in writable directories (e.g., uploads folder); web shells or backdoor scripts with recent modification timestamps.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) following shortcode rendering.
• Network: Outbound connections from the web server to unknown external IPs, particularly following page rendering events.

Update the Flexi Product Slider and Grid for WooCommerce plugin to a version beyond 1.0.5 that includes proper sanitization and validation of the theme parameter. If an updated version is not yet available, disable or remove the plugin immediately. As a defense-in-depth measure, restrict Contributor-level user registration and post creation capabilities, and deploy a Web Application Firewall (WAF) to detect and block path traversal patterns in shortcode parameters (Feedly, Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for February 9–15, 2026, highlighting it as part of a broader set of plugin-level LFI issues (Wordfence). RedPacket Security published an alert and shared it on Mastodon, contributing to community awareness (RedPacket Security). INCIBE (Spain's national cybersecurity agency) also issued an early warning advisory for this vulnerability (INCIBE).