The Custom Query Shortcode plugin for WordPress contains a path traversal vulnerability in the 'lens' parameter of all releases up to 0.4.0. An attacker who can authenticate as a contributor or higher can supply a crafted lens value and cause the plugin to read arbitrary files from the server. Because the contents of those files may include configuration data, credentials or other sensitive information, the flaw results in an information disclosure that jeopardises confidentiality of the site.

Any site running the Custom Query Shortcode plugin version 0.4.0 or earlier is vulnerable. The plugin is distributed under the name Custom Query Shortcode by developer Peter Hebert. Because the vulnerability is present in all pre‑0.4.0 releases, the entire set of WordPress installations that installed the plugin in those versions is at risk.

The flaw carries a CVSS score of 6.5 and an EPSS score of less than 1 %, indicating moderate severity but a very low probability of automated exploitation. The vulnerability requires authenticated access with at least contributor privileges, so an attacker must already have a valid account. Because the attack vector is via a WordPress shortcode parameter, exploitation is limited to contexts where the plugin is active; it is not a remote unprivileged exploit. The absence of a KEV listing means there are currently no publicly known exploits, although the method is straightforward once the vulnerability is known.