What the vulnerability does
01Description
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the `pgcu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php files can be uploaded and included.
Explanation of Vulnerability in Simple Terms
02Summary
A vulnerability in Post Grid, Slider & Carousel Ultimate allows authenticated users with low privileges to execute arbitrary code on the site. The flaw stems from improper handling of user input, enabling attackers to run their own PHP code. All versions up to 1.6.10 are affected. Site administrators should update immediately to a version newer than 1.6.10.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site with the privileges of the WordPress user account.
Potential impact on your site
04Site Impact
An attacker with a low-privilege account can compromise your entire site, steal data, modify content, or install malware.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., contributor or subscriber role).
Key dates
06Disclosure timeline
January 24, 2025
CVE published
April 8, 2026
Record updated
