CVE-2026-1988: WordPress Flexi Product Slider Plugin LFI

CVE-2026-1988 Overview

The Flexi Product Slider and Grid for WooCommerce plugin for WordPress contains a Local File Inclusion (LFI) vulnerability in all versions up to and including 1.0.5. The vulnerability exists in the flexipsg_carousel shortcode handler where the theme parameter is directly concatenated into a file path without proper sanitization or validation, enabling directory traversal attacks. This allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary PHP files on the server, potentially leading to full site compromise.

Critical Impact

Authenticated attackers with Contributor privileges can execute arbitrary PHP code on vulnerable WordPress installations, potentially leading to complete server compromise, data theft, and persistent backdoor installation.

Affected Products

• Flexi Product Slider and Grid for WooCommerce plugin versions up to and including 1.0.5
• WordPress installations using the vulnerable plugin
• WooCommerce-based e-commerce sites with the affected plugin enabled

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-1988 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-1988

Vulnerability Analysis

This Local File Inclusion vulnerability arises from improper handling of user-controlled input within the flexipsg_carousel shortcode implementation. The plugin accepts a theme parameter that specifies which template file to load for rendering product sliders. However, the parameter value is directly concatenated into a file path without any sanitization, basename extraction, or allowlist validation.

The vulnerable code path allows attackers to traverse outside the intended template directory using sequences like ../ to reach arbitrary locations on the filesystem. When combined with the ability to upload files through other WordPress features or exploiting writable locations, attackers can achieve remote code execution by including PHP files they control.

While the attack requires Contributor-level authentication, this is a relatively low privilege threshold in WordPress environments where multiple users may have content creation capabilities. The vulnerability is classified under CWE-98 (PHP Remote File Inclusion) and CWE-22 (Path Traversal).

Root Cause

The root cause is the direct concatenation of user-supplied input into a file path without implementing proper security controls. The theme parameter from the shortcode attributes is appended to a base path and passed directly to PHP's file inclusion mechanism. The absence of input validation allows directory traversal sequences to escape the intended directory scope. Proper mitigation would require implementing an allowlist of valid theme names or using basename extraction to prevent path traversal.

Attack Vector

The attack is performed over the network by an authenticated user with at least Contributor-level privileges. The attacker crafts a WordPress post or page containing the flexipsg_carousel shortcode with a malicious theme parameter value. By using directory traversal sequences (../), the attacker can navigate to arbitrary filesystem locations and include PHP files outside the intended template directory.

For example, an attacker could:

1. Upload a malicious PHP file through legitimate WordPress upload functionality
2. Create a post with a shortcode that traverses to the uploaded file location
3. Preview or publish the post to trigger the file inclusion and execute arbitrary PHP code

The vulnerable code can be reviewed in the WordPress Plugin Trac repository. Additional details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-1988

Indicators of Compromise

• Unusual shortcode usage patterns in posts or pages containing flexipsg_carousel with atypical theme values
• Web server logs showing requests to pages with directory traversal sequences (e.g., ../) in parameters
• Unexpected PHP file access patterns in application logs, particularly files outside the plugin's template directory
• New or modified PHP files in writable directories such as uploads or temp folders

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block directory traversal patterns in requests
• Monitor WordPress post content for shortcodes containing suspicious parameter values or traversal sequences
• Enable PHP open_basedir restrictions to limit file access scope and generate alerts on violations
• Review WordPress user activity logs for Contributor-level users creating posts with unusual shortcode patterns

Monitoring Recommendations

• Configure file integrity monitoring for the WordPress installation to detect unauthorized PHP file additions
• Set up alerting for PHP errors related to file inclusion failures or open_basedir restrictions
• Monitor network traffic for exfiltration patterns following potential exploitation
• Implement logging for all shortcode processing to enable forensic analysis if compromise is suspected

How to Mitigate CVE-2026-1988

Immediate Actions Required

• Update the Flexi Product Slider and Grid for WooCommerce plugin to a version newer than 1.0.5 if a patch is available
• Temporarily disable or remove the vulnerable plugin until a patched version can be applied
• Audit posts and pages for malicious shortcode content that may indicate prior exploitation attempts
• Review Contributor-level and above user accounts for unauthorized access or suspicious activity

Patch Information

Organizations should check the WordPress Plugin Repository for updated versions of the plugin that address this vulnerability. The fix should implement proper input validation by using an allowlist of permitted theme values or applying basename() to the theme parameter to prevent directory traversal. Additional technical details and remediation guidance can be found in the Wordfence Threat Intel report.

Workarounds

• Remove the flexipsg_carousel shortcode handler by deactivating the plugin until a patch is available
• Implement a custom filter to sanitize the theme parameter before it reaches the vulnerable code path
• Restrict Contributor-level user permissions or require editorial review for posts containing shortcodes
• Apply PHP open_basedir restrictions to limit file inclusion scope at the server level

# WordPress workaround: Disable the vulnerable shortcode via functions.php
# Add this to your theme's functions.php to remove the shortcode
remove_shortcode('flexipsg_carousel');

# Server-level mitigation: Add open_basedir restriction in php.ini
# open_basedir = /var/www/html/:/tmp/