Shortcodes

02/26/2014

Including a PHP file from a WordPress shortcode, safely

The 2014 version of this shortcode takes a file path out of the post and includes it, which is a local file inclusion hole with extra steps. The fix is small: let the code decide which files are includable, not the person writing the post.