What is the CVSS score of CVE-2026-57798?

CVE-2026-57798 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of NewsPlus Shortcodes are affected by CVE-2026-57798?

The NewsPlus Shortcodes WordPress plugin (versions 4.2.0 and earlier) contains a local file inclusion vulnerability allowing authenticated users with administrative privileges to access sensitive…

How to fix or mitigate CVE-2026-57798?

Within 24 hours: audit all WordPress instances for NewsPlus Shortcodes plugin version 4.2.0 or earlier and document deployment scope. Within 7 days: disable the plugin entirely if operations permit, or restrict access strictly to trusted administrative users; review and enforce least-privilege WordPress user role assignments. Within 30 days: execute permanent remediation by removing the plugin and deploying alternative shortcode solutions, or establish continuous monitoring of file access patterns with alert rules for suspicious include/require operations.

NewsPlus Shortcodes CVE-2026-57798

EUVD-2026-43414 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

Information Disclosure LFI PHP Newsplus Shortcodes

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Authenticated low-privilege user needed (PR:L) over the network (AV:N) with non-trivial path crafting (AC:H); PHP inclusion can read files and execute code, giving full C/I/A impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:29 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SaurabhSharma NewsPlus Shortcodes newsplus-shortcodes allows PHP Local File Inclusion.This issue affects NewsPlus Shortcodes: from n/a through <= 4.2.0.

AnalysisAI

Local File Inclusion in the NewsPlus Shortcodes WordPress plugin (versions up to and including 4.2.0) allows an authenticated attacker to coerce the plugin into including arbitrary PHP-processable files from the server, enabling disclosure of sensitive files and potential code execution. The flaw stems from improper control of a filename passed to a PHP include/require statement (CWE-98). No public exploit was identified at the time of analysis, and it is not listed in CISA KEV; risk is moderated by high attack complexity and a required privilege level.

Technical ContextAI

The affected software is the SaurabhSharma 'NewsPlus Shortcodes' plugin for WordPress (CPE cpe:2.3:a:saurabhsharma:newsplus_shortcodes), a content/shortcode helper add-on. The root cause is CWE-98 ('PHP Remote File Inclusion'), where user-influenced input reaches a PHP include(), require(), include_once(), or require_once() statement without sufficient sanitization or allow-listing. In WordPress plugin contexts this typically manifests as a shortcode attribute, request parameter, or template selector being concatenated into an include path, so an attacker can traverse the filesystem (Local File Inclusion) to load files the include routine will parse as PHP. Because PHP evaluates any included file as code, inclusion of attacker-controllable or sensitive server files can escalate from information disclosure to arbitrary code execution.

RemediationAI

No fixed version is stated in the available data, so no vendor-released patched version can be independently confirmed at the time of analysis - check the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/newsplus-shortcodes/vulnerability/wordpress-newsplus-shortcodes-plugin-4-2-0-local-file-inclusion-vulnerability?_s_id=cve) and the WordPress plugin repository for a release above 4.2.0 and upgrade to it as the primary fix. If no patched release is yet available, the safest compensating control is to deactivate and remove the NewsPlus Shortcodes plugin, accepting the loss of its shortcode functionality on affected pages. Where removal is not acceptable, restrict which users can invoke the vulnerable functionality by tightening WordPress role assignments (since exploitation requires an authenticated low-privilege account), and place a WAF or virtual patch (Patchstack offers one) in front of the site to block path-traversal and file-inclusion payloads targeting the plugin's parameters; note that WAF rules are pattern-based and can be bypassed, so treat them as interim mitigation rather than a fix. Additionally, ensure PHP allow_url_include is disabled and open_basedir is configured to limit filesystem reach, which reduces the blast radius of any inclusion.