Search criteria

2 vulnerabilities found for Query Shortcode by shazdeh

CVE-2026-9200 (GCVE-0-2026-9200)

Vulnerability from nvd – Published: 2026-05-27 05:31 – Updated: 2026-05-27 10:38
VLAI
Title
Query Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute
Summary
The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.2.1 via the shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CWE
  • CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
Impacted products
Vendor Product Version
shazdeh Query Shortcode Affected: 0 , ≤ 0.2.1 (semver)
Create a notification for this product.
Credits
Muhammad Yudha - DJ
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9200",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T10:22:37.631646Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T10:38:37.601Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Query Shortcode",
          "vendor": "shazdeh",
          "versions": [
            {
              "lessThanOrEqual": "0.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Muhammad Yudha - DJ"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.2.1 via the shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-98",
              "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T05:31:21.554Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28df760b-6b15-41ca-b93f-9d24dbbd9fc4?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/query-shortcode/trunk/init.php#L97"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/query-shortcode/trunk/init.php#L178"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/query-shortcode/trunk/init.php#L56"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-26T17:25:25.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Query Shortcode \u003c= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via \u0027lens\u0027 Shortcode Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-9200",
    "datePublished": "2026-05-27T05:31:21.554Z",
    "dateReserved": "2026-05-21T15:43:41.982Z",
    "dateUpdated": "2026-05-27T10:38:37.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9200 (GCVE-0-2026-9200)

Vulnerability from cvelistv5 – Published: 2026-05-27 05:31 – Updated: 2026-05-27 10:38
VLAI
Title
Query Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute
Summary
The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.2.1 via the shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CWE
  • CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
Impacted products
Vendor Product Version
shazdeh Query Shortcode Affected: 0 , ≤ 0.2.1 (semver)
Create a notification for this product.
Credits
Muhammad Yudha - DJ
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9200",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T10:22:37.631646Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T10:38:37.601Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Query Shortcode",
          "vendor": "shazdeh",
          "versions": [
            {
              "lessThanOrEqual": "0.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Muhammad Yudha - DJ"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.2.1 via the shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-98",
              "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T05:31:21.554Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28df760b-6b15-41ca-b93f-9d24dbbd9fc4?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/query-shortcode/trunk/init.php#L97"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/query-shortcode/trunk/init.php#L178"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/query-shortcode/trunk/init.php#L56"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-26T17:25:25.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Query Shortcode \u003c= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via \u0027lens\u0027 Shortcode Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-9200",
    "datePublished": "2026-05-27T05:31:21.554Z",
    "dateReserved": "2026-05-21T15:43:41.982Z",
    "dateUpdated": "2026-05-27T10:38:37.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}