Skip to content
Threat Feed

Product

Query Shortcode Plugin <= 0.2.1

1 brief RSS
high threat

CVE-2026-9200: WordPress Query Shortcode Plugin Vulnerable to Local File Inclusion

The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion (CVE-2026-9200) in versions up to 0.2.1, allowing authenticated attackers with contributor-level access and above to include and execute arbitrary PHP files on the server, potentially leading to privilege escalation and code execution.

Query Shortcode plugin <= 0.2.1 local-file-inclusion wordpress plugin-vulnerability CVE-2026-9200
2r 2t 1c