Custom Query Shortcode WordPress Plugin Path Traversal Vulnerability

A path traversal vulnerability has been identified in the Custom Query Shortcode plugin for WordPress, affecting all versions through 0.4.0. The vulnerability arises in the 'lens' parameter, allowing authenticated attackers with Contributor-level access or higher to read files on the server that may contain sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information on the server.

Remediation

Users are advised to update the Custom Query Shortcode plugin to version 0.5.0 or later, where this vulnerability has been patched.