CVE-2026-9200

The record

The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.2.1 via the shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

Affected packages

Related vulnerabilities

• CVE-2026-62121 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote… CWE-98
• CVE-2010-20125 DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that… CWE-98
• CVE-2026-110185 The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google… CWE-98
• CVE-2014-125137 C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through… CWE-98
• CVE-2026-112850 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote… CWE-98
• CVE-2017-20289 Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file… CWE-98
• CVE-2016-20101 Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability… CWE-98
• CVE-2026-87927 MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and… CWE-98