CVE-2026-1988 PUBLISHED

Flexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute

Assigner: Wordfence
Reserved: 05.02.2026 Published: 14.02.2026 Updated: 14.02.2026

The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the flexipsg_carousel shortcode. This is due to the theme parameter being directly concatenated into a file path without proper sanitization or validation, allowing directory traversal. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server via the theme parameter granted they can create posts with shortcodes.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.5

Product Status

Vendor wpdecent
Product Flexi Product Slider and Grid for WooCommerce
Versions Default: unaffected
  • affected from * to 1.0.5 (incl.)

Credits

  • Muhammad Yudha - DJ finder

References

Problem Types

  • CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE