WordPress Plugin Vulnerabilities

All in One Visual Composer Addons <= 1.2 - Contributor+ LFI via vca_tabs_style Shortcode Attribute

Description

The plugin does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.

Proof of Concept

Affects Plugins

Plugin icon
all-in-one-visual-composer-addons
No known fix

References

CVE
CVE-2026-110516

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
JunHee CHO
Submitter
JunHee CHO
Verified
Yes
WPVDB ID
bce6e184-91b9-444b-bb23-c356cf0488cd

Timeline

Publicly Published
2026-11-07 (about 2 days ago)
Added
2026-10-31 (about 9 days ago)
Last Updated
2026-10-31 (about 9 days ago)

Other

Published
Title
Published
2024-06-19
Title
Shariff Wrapper < 4.6.14 - Unauthenticated Local File Inclusion
Published
2026-01-27
Title
Snow Monkey Forms < 12.0.4 - Unauthenticated Arbitrary File Deletion
Published
2026-08-14
Title
Link Library < 7.9.5 - Unauthenticated Arbitrary File Deletion via link_url Parameter
Published
2026-04-01
Title
MW WP Form < 5.1.1 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir
Published
2014-08-01
Title
Theme My Login 6.3.9 - Local File Inclusion