NewsPlus Shortcodes CVE-2026-57798

Exploitation requires an authenticated WordPress session at a low privilege level (CVSS PR:L) and the ability to reach the plugin's file-inclusion code path - meaning the NewsPlus Shortcodes plugin (<= 4.2.0) must be installed and active on the target site. The AC:H metric indicates success is not guaranteed on the first attempt: the attacker must satisfy additional conditions such as crafting a valid traversal path to a PHP-parseable file and defeating any partial input filtering. Limiting factors that reduce real-world risk: an attacker cannot exploit this fully unauthenticated (some account is needed), no user interaction by a victim is required (UI:N), and effectiveness depends on server configuration (e.g., filesystem permissions, open_basedir, and whether an includable payload can be planted). The condition is therefore 'active NewsPlus Shortcodes plugin at version 4.2.0 or earlier, reachable by an authenticated low-privilege user.'

Signals are mixed and point to a real-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5 High) indicates network reachability and full CIA impact, but two dampeners stand out: AC:H means the attack is not trivially reliable (likely requiring specific conditions or path manipulation to succeed) and PR:L means the attacker must already hold some authenticated WordPress role. There is no EPSS score provided, no CISA KEV listing, and no evidence of a public proof-of-concept, so this is not confirmed as actively exploited. No SSVC decision data was supplied. Net: a legitimate patch-worthy vulnerability, but its combination of high complexity plus required privileges places it below internet-facing, unauthenticated, actively-exploited flaws in priority. Note a mild internal tension worth verifying: the tags label this 'Information Disclosure / LFI' (suggesting primarily confidentiality), yet the vector asserts I:H and A:H - consistent with PHP inclusion enabling code execution, but the integrity/availability impact should be confirmed against the vendor advisory.

An attacker who holds a low-privilege authenticated WordPress account (for example a subscriber or contributor on a site that allows self-registration) submits a crafted request or shortcode whose filename parameter is manipulated with path traversal to point at a sensitive server file such as wp-config.php or an uploaded payload. The plugin includes that path via a PHP include/require, disclosing credentials or executing PHP code; the high attack complexity means the attacker may need several attempts to land a working path. No public proof-of-concept was identified at time of analysis.