CVE-2025-11704 describes a Local File Inclusion vulnerability in the Elegance Menu plugin for WordPress, affecting all versions up to 1.9. The issue arises from improper control of the filename used in the include/require statement via the 'elegance-menu' shortcode attribute. Authenticated users with at least Contributor privileges can exploit this to include arbitrary PHP files on the server, potentially executing malicious code. The vulnerability is classified under CWE-98 and has a CVSS 3.1 base score of 7.5, indicating high impact on confidentiality, integrity, and availability.

Successful exploitation allows authenticated attackers to execute arbitrary PHP code on the server, which can lead to bypassing access controls, unauthorized data disclosure, and full system compromise. The attack requires at least Contributor-level access, limiting exposure to authenticated users. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the Elegance Menu plugin. Avoid uploading PHP files that could be included via the vulnerable shortcode attribute.