What the vulnerability does
01Description
The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the `flexipsg_carousel` shortcode. This is due to the `theme` parameter being directly concatenated into a file path without proper sanitization or validation, allowing directory traversal. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server via the `theme` parameter granted they can create posts with shortcodes.
Explanation of Vulnerability in Simple Terms
02Summary
Flexi Product Slider and Grid for WooCommerce versions 1.0.5 and earlier contain a vulnerability that allows authenticated users with low privileges to read sensitive data, modify site content, or disrupt service. The vulnerability requires high attack complexity but can be exploited remotely without user interaction. Site administrators should update immediately to a version newer than 1.0.5.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify site content, or disrupt service on the affected WooCommerce site.
Potential impact on your site
04Site Impact
Authenticated attackers can access confidential information, alter product data, or cause service disruption.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site and exploit requires high technical complexity.
Key dates
06Disclosure timeline
February 14, 2026
CVE published
April 8, 2026
Record updated
