CVE-2026-9200 is a Local File Inclusion vulnerability (CWE-98) in the Query Shortcode WordPress plugin by shazdeh. The flaw exists in the shortcode function, permitting authenticated attackers with contributor or higher privileges to include arbitrary .php files on the server. This enables execution of any PHP code contained in those files, potentially allowing privilege escalation, data disclosure, or remote code execution. The vulnerability affects all versions up to and including 0.2.1. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

Exploitation allows authenticated users with contributor-level access or above to execute arbitrary PHP code on the server by including malicious .php files. This can lead to bypassing access controls, unauthorized data access, and full code execution on the affected system. The vulnerability poses a high risk to the confidentiality, integrity, and availability of the WordPress environment running the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access and above to trusted users only. Monitor for plugin updates from the vendor and apply them promptly once available.