CVE-2026-1988 is a Local File Inclusion vulnerability in the wpdecent Flexi Product Slider and Grid for WooCommerce plugin for WordPress, affecting all versions up to 1.0.5. The vulnerability arises from improper control of the filename used in an include/require statement within the flexipsg_carousel shortcode, specifically due to the unsanitized theme parameter. This allows authenticated users with Contributor-level permissions or higher to perform directory traversal and include arbitrary PHP files on the server, potentially leading to remote code execution. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

Successful exploitation allows an authenticated user with Contributor-level access or above to include and execute arbitrary PHP files on the server. This can lead to full compromise of the affected WordPress site, including unauthorized code execution, data disclosure, and potential site takeover. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Flexi Product Slider and Grid for WooCommerce plugin if possible. Monitor for updates from the vendor and apply any official patches promptly once available.