CVE-2026-1257: WordPress Administrative Shortcodes RCE

CVE-2026-1257 Overview

The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to, and including, 0.3.4. The vulnerability exists in the slug attribute of the get_template shortcode due to insufficient path validation on user-supplied input passed to the get_template_part() function. This makes it possible for authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files.

Critical Impact

This vulnerability can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included. Attackers with relatively low privileges (Contributor-level) can escalate to full server compromise.

Affected Products

• Administrative Shortcodes plugin for WordPress versions ≤ 0.3.4
• WordPress sites using the affected plugin with Contributors or higher user roles

Discovery Timeline

• 2026-01-24 - CVE CVE-2026-1257 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-1257

Vulnerability Analysis

This Local File Inclusion vulnerability occurs within the Administrative Shortcodes plugin's shortcode processing functionality. The get_template shortcode accepts a slug attribute that is passed directly to WordPress's get_template_part() function without adequate sanitization or path validation. This architectural flaw allows attackers to manipulate the file path and include arbitrary PHP files from the server's filesystem.

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which describes scenarios where user input influences PHP file inclusion operations without proper validation. The attack requires network access and authenticated user privileges at the Contributor level or above, but once these conditions are met, exploitation can lead to complete server compromise.

Root Cause

The root cause is insufficient path validation on user-supplied input within the slug attribute processing. The vulnerable code at line 144 of administrative-shortcodes.php passes the user-controlled slug parameter to get_template_part() without sanitizing for path traversal sequences or validating that the requested file exists within an expected directory structure. This allows attackers to traverse outside the intended template directory and include arbitrary PHP files.

Attack Vector

The attack vector is network-based, requiring an authenticated session with Contributor-level permissions or higher. An attacker would craft a malicious shortcode with a manipulated slug attribute containing path traversal sequences (e.g., ../) to include files outside the intended template directory.

The attack chain typically follows these steps:

1. Attacker authenticates to WordPress with Contributor-level access or higher
2. Attacker creates or edits content containing a malicious get_template shortcode
3. The shortcode includes a crafted slug value with path traversal sequences
4. When the page is rendered, the vulnerable code includes the attacker-specified file
5. If the included file contains PHP code, it executes in the context of the WordPress application

In scenarios where file uploads are permitted, attackers can upload a file with embedded PHP code (disguised as an image or other "safe" file type) and then use this LFI vulnerability to include and execute that uploaded file, achieving remote code execution.

Detection Methods for CVE-2026-1257

Indicators of Compromise

• Unusual access patterns to WordPress content creation endpoints by Contributor-level users
• Post or page content containing get_template shortcodes with path traversal sequences (../)
• Web server logs showing requests that result in unexpected file inclusions
• Uploaded files with PHP code embedded within image headers or other file types
• Unexpected PHP execution errors in error logs referencing non-template files

Detection Strategies

• Review WordPress posts and pages for suspicious get_template shortcode usage with unusual slug values
• Implement web application firewall rules to detect path traversal patterns in request parameters
• Monitor for unusual file access patterns in WordPress installations, particularly in non-standard directories
• Audit user activity logs for Contributors creating content with embedded shortcodes

Monitoring Recommendations

• Enable detailed logging for WordPress shortcode processing
• Monitor file system access for PHP files outside the standard theme and plugin directories
• Set up alerts for new or modified content containing get_template shortcodes
• Review web server access logs for patterns indicating LFI exploitation attempts

How to Mitigate CVE-2026-1257

Immediate Actions Required

• Update the Administrative Shortcodes plugin to a version newer than 0.3.4 if a patched version is available
• If no patch is available, deactivate and remove the Administrative Shortcodes plugin until a fix is released
• Review existing posts and pages for malicious get_template shortcode usage
• Audit user accounts with Contributor-level access and above for suspicious activity
• Consider restricting Contributor-level permissions if the plugin must remain active

Patch Information

Organizations should monitor the WordPress Administrative Shortcodes Plugin page for updated versions that address this vulnerability. Additional details are available in the Wordfence Vulnerability Report. The vulnerable code can be reviewed at the WordPress Plugin Source Code repository.

Workarounds

• Disable the get_template shortcode functionality by adding a filter to remove it from the registered shortcodes
• Implement input validation at the theme level to sanitize any slug parameters before they reach get_template_part()
• Use a web application firewall (WAF) to block requests containing path traversal sequences
• Restrict file upload capabilities to trusted administrators only

# WordPress configuration to disable the vulnerable shortcode
# Add to your theme's functions.php or a custom plugin

# Remove the vulnerable shortcode registration
remove_shortcode('get_template');

# Alternative: Add this to wp-config.php to prevent Contributors from using shortcodes
# Note: This affects all shortcodes, not just the vulnerable one
define('DISALLOW_UNFILTERED_HTML', true);