The vulnerability CVE-2026-57798 in SaurabhSharma NewsPlus Shortcodes arises from improper control of filenames used in PHP include or require statements, resulting in a Local File Inclusion vulnerability. This flaw affects versions up to 4.2.0, enabling an attacker with low privileges to potentially execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no user interaction required. No vendor advisory or patch information is currently available to confirm remediation status.

An attacker with low privileges can exploit this vulnerability remotely over the network without user interaction. The vulnerability allows local file inclusion, which can lead to disclosure of sensitive information, code execution, or denial of service, impacting confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable plugin and monitor for any suspicious activity related to file inclusion attempts.