{"id":"CVE-2026-110516","kind":"vulnerability","aliases":["CVE-2026-110516"],"related":[],"title":"WPBakery addons WordPress plugin: shortcode attribute enables local PHP file execution","description":"The All in One Addons For WPBakery Page Builder  (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.","summary":"The All in One Addons for WPBakery Page Builder WordPress plugin, through version 1.2, does not validate a shortcode attribute before using it in a file path that is included and executed. An attacker with contributor-level WordPress access can include and run arbitrary local PHP files on the server.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"All in One Addons For WPBakery Page Builder","fixed":[],"affected":"<= 1.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["lfi","package","php","wordpress","wpbakery"],"not_affected_if":["no-contributor-users","plugin-not-installed"],"how_to_check":"- Plugin slug is all-in-one-visual-composer-addons. Run: wp plugin get all-in-one-visual-composer-addons --field=version (or see Plugins in wp-admin). Version 1.2 or lower is vulnerable.\n- Search post content for the vca_tabs_style shortcode attribute: wp db query \"SELECT ID FROM wp_posts WHERE post_content LIKE '%vca_tabs_style%'\", and review posts by contributor-level users.","fix":"No fixed version known as of 2026-11-10 (WPScan lists no known fix). Deactivate and remove the plugin, or restrict the contributor role until a patch ships.","status":"open","published_at":"2026-11-10T06:17:07+00:00","first_seen_at":"2026-11-10T06:20:22+00:00","triaged_at":"2026-11-10T06:22:25+00:00","updated_at":"2026-11-10T06:25:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T06:22:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WPBakery addons WordPress plugin: shortcode attribute enables local PHP file execution","impact":"high","summary":"The All in One Addons for WPBakery Page Builder WordPress plugin, through version 1.2, does not validate a shortcode attribute before using it in a file path that is included and executed. An attacker with contributor-level WordPress access can include and run arbitrary local PHP files on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpbakery","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary local PHP files on the server","analyst_note":"Confirm the fixed version and the exact vulnerable shortcode from the NVD entry or the plugin's vendor page at https://nvd.nist.gov/vuln/detail/CVE-2026-110516.","how_to_check":"- Check whether the plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available.\n- Look for the plugin's shortcodes in posts written by contributor-level users.","plain_action":"","product_name":"All in One Addons For WPBakery Page Builder","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-contributor-users"],"who_is_affected":"Sites running the All in One Addons for WPBakery Page Builder plugin through version 1.2 that let contributor-level or higher users create or edit content. The sources do not state which shortcodes or settings are required for the flaw to be reachable. Sites without this plugin, or with it removed, are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00078,"input_tokens":4555,"output_tokens":648,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the exact vulnerable shortcode from the NVD entry or the plugin's vendor page at https://nvd.nist.gov/vuln/detail/CVE-2026-110516.","search":"'-110516':14A,17A '-2026':13A,16A '1.2':44B,97C 'access':70B 'addon':2A,35B,86C 'addons':21A 'all':18A 'allow':119C 'arbitrari':75B,131C 'attack':64B 'attribut':6A,50B,103C 'build':108C 'builder':25A,39B,90C 'compos':93C 'contributor':67B,123C 'contributor-level':66B 'could':118C 'cve':12A,15A 'enabl':7A 'execut':11A,62B,116C,130C 'file':10A,56B,78B,110C,134C 'for':22A 'former':91C 'in':19A 'includ':60B,72B,114C,128C 'level':68B 'lfi':26B 'local':8A,76B,132C 'one':20A,34B,85C 'packag':27B 'page':24A,38B,89C 'path':57B,111C 'php':9A,28B,77B,133C 'plugin':4A,41B,95C 'role':124C 'run':74B 'server':81B,137C 'shortcod':5A,49B,102C 'use':52B,105C 'user':120C 'valid':47B,100C 'version':43B 'visual':92C 'wordpress':3A,29B,40B,69B,94C 'wpbakeri':1A,30B,37B,88C 'wpbakery':23A","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the All in One Addons For WPBakery Page Builder plugin (slug all-in-one-visual-composer-addons) at version 1.2 or lower, where anyone holds a contributor role or above. The vca_tabs_style shortcode attribute is used to build a file path that is included and executed, so a contributor can run local PHP files on the server. Sites without the plugin, or without untrusted contributor-level accounts, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["allinoneaddonsforwpbakerypagebuilder","inoneaddonsforwpbakerypagebuilder"],"ptokens":["addons","all","builder","for","in","one","page","wpbakery"],"labels":["high","lfi","package","php","vendor","wordpress","wpbakery"],"campaign_type":null,"search_a":"'-110516':14A,17A '-2026':13A,16A 'addon':2A 'addons':21A 'all':18A 'attribut':6A 'builder':25A 'cve':12A,15A 'enabl':7A 'execut':11A 'file':10A 'for':22A 'in':19A 'local':8A 'one':20A 'page':24A 'php':9A 'plugin':4A 'shortcod':5A 'wordpress':3A 'wpbakeri':1A 'wpbakery':23A","search_b":"'1.2':44B 'access':70B 'addon':35B 'arbitrari':75B 'attack':64B 'attribut':50B 'builder':39B 'contributor':67B 'contributor-level':66B 'execut':62B 'file':56B,78B 'includ':60B,72B 'level':68B 'lfi':26B 'local':76B 'one':34B 'packag':27B 'page':38B 'path':57B 'php':28B,77B 'plugin':41B 'run':74B 'server':81B 'shortcod':49B 'use':52B 'valid':47B 'version':43B 'wordpress':29B,40B,69B 'wpbakeri':30B,37B","search_c":"'1.2':97C 'addon':86C 'allow':119C 'arbitrari':131C 'attribut':103C 'build':108C 'builder':90C 'compos':93C 'contributor':123C 'could':118C 'execut':116C,130C 'file':110C,134C 'former':91C 'includ':114C,128C 'local':132C 'one':85C 'page':89C 'path':111C 'php':133C 'plugin':95C 'role':124C 'server':137C 'shortcod':102C 'use':105C 'user':120C 'valid':100C 'visual':92C 'wordpress':94C 'wpbakeri':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T06:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110516","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110516","severity":null,"published_at":"2026-11-10T06:17:07+00:00","modified_at":"2026-11-10T06:17:07+00:00","first_seen_at":"2026-11-10T06:20:22+00:00","fetched_at":"2026-11-10T06:20:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110516:2420","url":"https://wpscan.com/vulnerability/bce6e184-91b9-444b-bb23-c356cf0488cd/","severity":null,"published_at":"2026-11-10T06:25:56+00:00","modified_at":"2026-11-10T06:25:56+00:00","first_seen_at":"2026-11-10T06:25:56+00:00","fetched_at":"2026-11-10T06:25:56+00:00","note":"NVD (via API) + WPScan: plugin slug all-in-one-visual-composer-addons, <= 1.2, no known fix per WPScan (aggregator, not vendor, so nothing marked verified). Vulnerable input is the vca_tabs_style shortcode attribute; WPScan PoC due 2026-11-21. Did not read plugin's wordpress.org page or a vendor statement; web-cli unused (not available).","cites":["https://wpscan.com/vulnerability/bce6e184-91b9-444b-bb23-c356cf0488cd/"]}],"documents":[{"id":113506,"url":"https://wpscan.com/vulnerability/bce6e184-91b9-444b-bb23-c356cf0488cd/","title":"WPScan: All in One Addons For WPBakery Page Builder <= 1.2 - Contributor+ LFI","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}