CVE-2025-11704: Elegance Menu WordPress Plugin RCE Flaw

CVE-2025-11704 Overview

CVE-2025-11704 is a Local File Inclusion (LFI) vulnerability affecting the Elegance Menu plugin for WordPress in all versions up to and including 1.9. The flaw resides in the elegance-menu attribute of the elegance-menu shortcode. Authenticated attackers with Contributor-level access or higher can include and execute arbitrary .php files on the server. Successful exploitation allows attackers to bypass access controls, read sensitive data, or achieve remote code execution when combined with file upload primitives. The issue is tracked under CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program.

Critical Impact
Authenticated attackers with Contributor privileges can execute arbitrary PHP code on affected WordPress sites, leading to full site compromise.

Affected Products

WordPress Elegance Menu plugin versions 1.0 through 1.9
WordPress sites with the plugin installed and active
Sites allowing Contributor-level (or higher) user registration

Discovery Timeline

2025-11-04 - CVE-2025-11704 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11704

Vulnerability Analysis

The Elegance Menu plugin exposes a shortcode named elegance-menu that accepts a user-controlled attribute also named elegance-menu. The plugin passes this attribute value into a PHP include or require statement without sufficient validation or path normalization. As a result, an authenticated user who can publish posts containing shortcodes — including Contributors — can supply a relative or absolute path that references arbitrary .php files on the underlying filesystem.

Because WordPress shortcodes are rendered server-side during page generation, the included file is parsed and executed within the plugin's PHP context. Attackers can target sensitive configuration files, log files containing user-controlled content, or files written through other upload mechanisms to achieve code execution. The vulnerability falls under CWE-98.

Root Cause

The root cause is unsanitized concatenation of a shortcode attribute into a PHP file inclusion call in class-elegance-menu-public.php. The plugin trusts the shortcode parameter without enforcing an allowlist of permitted template names or restricting the lookup to a specific directory. See the WordPress Plugin Code Review for the affected code path.

Attack Vector

An attacker first authenticates to the target WordPress site with a Contributor account or higher. The attacker creates or edits a post containing the elegance-menu shortcode and sets the elegance-menu attribute to a path that resolves to an attacker-controlled or sensitive .php file. When the post is previewed or rendered, the plugin includes and executes the referenced file. The exploitation pathway is described in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-11704

Indicators of Compromise

Post or page content containing the [elegance-menu elegance-menu="..."] shortcode with suspicious path traversal sequences such as ../ or absolute paths
Unexpected PHP execution originating from the wp-content/plugins/elegance-menu/ directory
New or modified Contributor-level accounts followed by post creation containing the elegance-menu shortcode
Web server access logs showing post previews or renders by low-privilege users immediately followed by anomalous PHP errors or outbound connections

Detection Strategies

Inspect the WordPress posts and postmeta tables for shortcode payloads referencing non-standard file paths in the elegance-menu attribute
Monitor PHP error logs for include() or require() warnings referencing files outside the plugin's expected template directory
Apply file integrity monitoring on the WordPress installation to detect newly written PHP files in upload directories

Monitoring Recommendations

Alert on Contributor or Author role accounts creating posts containing shortcode attributes with .php extensions or directory traversal characters
Forward WordPress audit logs and web server logs to a centralized SIEM for correlation across user activity and file inclusion events
Review plugin inventory and flag installations of Elegance Menu version 1.9 or earlier for prioritized remediation

How to Mitigate CVE-2025-11704

Immediate Actions Required

Deactivate and remove the Elegance Menu plugin until a patched release is verified on the plugin page
Audit user accounts and remove unused or untrusted Contributor, Author, and Editor accounts
Review all posts and drafts for the elegance-menu shortcode and remove suspicious attribute values
Rotate WordPress secret keys, database credentials, and administrator passwords if exploitation is suspected

Patch Information

The plugin maintainer addressed the vulnerability in WordPress Changeset #3409312. Site operators should update Elegance Menu to a version newer than 1.9 once available, or remove the plugin if no patched release is published.

Workarounds

Restrict post creation and editing capabilities by limiting Contributor-level access to trusted users only
Deploy a web application firewall rule that blocks requests containing the elegance-menu shortcode with path traversal sequences or .php extensions
Configure PHP open_basedir to constrain file inclusion to the WordPress installation directory, reducing the impact of LFI primitives
Disable PHP execution in wp-content/uploads/ and other user-writable directories via web server configuration

bash

# Apache configuration to block PHP execution in uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>

# PHP open_basedir restriction in php.ini
open_basedir = "/var/www/html:/tmp"