The Query Shortcode plugin for WordPress contains a Local File Inclusion flaw triggered by the 'lens' shortcode attribute. An authenticated user with Contributor or higher privileges can embed a crafted shortcode in a post or page, causing the plugin to include a server‑side file path. If the file is a PHP script, its contents execute within the WordPress context, allowing the attacker to bypass access controls, read or modify sensitive files, or run arbitrary PHP code.

The vulnerability affects all WordPress sites running the Query Shortcode plugin by shazdeh, versions up to and including 0.2.1. Any installation of the plugin before the patched release is vulnerable; no other vendors or products are implicated.

With a CVSS score of 7.5 the issue is considered high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, indicating no widespread exploitation yet. The flaw requires an authenticated user with at least Contributor role and the ability to add the 'lens' shortcode. Once these conditions are met, the attacker can include arbitrary files and execute PHP code, posing a substantial risk to confidentiality, integrity, and availability of the WordPress installation.