What is the CVSS score of CVE-2026-9200?

CVE-2026-9200 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Query Shortcode are affected by CVE-2026-9200?

The Query Shortcode WordPress plugin (all versions through 0.2.1) permits authenticated users at contributor level and above to include and execute arbitrary PHP files on the server, enabling remote…

How to fix or mitigate CVE-2026-9200?

Within 24 hours: disable Query Shortcode plugin version 0.2.1 and below; audit access logs for all users assigned contributor role or above. Within 7 days: uninstall the plugin completely and search WordPress debug logs for file inclusion attempts targeting wp-content/ and wp-plugins/. Within 30 days: implement role-based access controls limiting contributor assignments to essential content editors only; establish automated security update monitoring for all installed plugins.

Query Shortcode CVE-2026-9200

EUVD-2026-32062 HIGH

PHP Remote File Inclusion (CWE-98)

2026-05-27 security@wordfence.com

GHSA-m654-52c2-fwxx

PHP WordPress Information Disclosure RCE LFI

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 19:55 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

HIGH 7.5

DescriptionCVE.org

The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.2.1 via the shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

AnalysisAI

Local File Inclusion in the Query Shortcode plugin for WordPress (all versions through 0.2.1) lets authenticated users with contributor-level access or higher coerce the shortcode handler into including and executing arbitrary .php files already present on the server. Because included files are run by the PHP interpreter, this can leak sensitive data, bypass access controls, and escalate to full remote code execution where an attacker can also place a .php file (e.g. via an upload feature). EPSS rates near-term exploitation probability very low (0.07%, 21st percentile) and there is no public exploit identified at time of analysis.

Technical ContextAI

The flaw is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in a PHP Program), the root-cause class behind PHP file inclusion bugs. The plugin's shortcode function (see init.php around lines 56, 97, and 178 in the WordPress plugin trac) passes attacker-influenced input into a PHP include/require path without adequately restricting it to an allowlisted location, so a path that resolves to a local .php file is loaded and executed in the application context. WordPress shortcodes are interpreted when a post or page is rendered, so any role permitted to author shortcode-bearing content can reach the vulnerable code path. No CPE string was provided in the source data; affected-product identity is drawn from the NVD/EUVD description and the plugin slug 'query-shortcode'.

RemediationAI

No vendor-released patched version is identified in the available data, so a specific fix version cannot be cited; monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/28df760b-6b15-41ca-b93f-9d24dbbd9fc4?source=cve) and the WordPress plugin page for an update beyond 0.2.1 and apply it once published. Until a patch is confirmed, the most decisive control is to deactivate and remove the Query Shortcode plugin, accepting the trade-off that any content relying on its shortcodes will stop rendering. If the plugin must remain active, restrict contributor-and-above accounts to trusted users and review existing contributor accounts, since the exploit requires that privilege level; additionally block the ability for those roles to upload or place .php files (enforce upload allowlists / disable PHP execution in the uploads directory) to prevent escalation from file inclusion to arbitrary code execution. A WordPress-aware WAF (such as Wordfence) can provide virtual patching as a stopgap, with the caveat that signature-based blocking may be incomplete against path-manipulation variants.