The Elegance Menu plugin for WordPress contains a flaw in the handling of the 'elegance-menu' attribute of its shortcode. The bug, classified as CWE-98, allows an authenticated user with Contributor privilege or higher to cause the plugin to include arbitrary files present on the server. When a .php file is included, its contents are executed, effectively granting code execution on the WordPress installation. This can lead to privilege escalation, data theft, and full compromise of the site where the plugin is installed.

ImpactTechLab’s Elegance Menu plugin, any WordPress installation using versions 1.9 or earlier. No additional version details are provided beyond the latest vulnerable release, 1.9.

The CVSS score of 7.5 indicates a high severity risk. The EPSS score of less than 1% shows that, as of the data collection, exploitation activity is rare, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack requires only Contributor-level access, which many sites grant to content editors, making the risk tangible. An attacker can upload a malicious PHP file and then trigger the LFI via the short‑code attribute, obtaining remote code execution on the web server.