Limited Local File Inclusion in MultiVendorX Plugin for WooCommerce by WordPress
CVE-2025-0493
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 31 January 2025
What is CVE-2025-0493?
The MultiVendorX plugin, designed for WooCommerce environments, is susceptible to a Local File Inclusion vulnerability through the 'tabname' parameter. This flaw enables unauthenticated attackers to include arbitrary PHP files stored on the server, leading to potential code execution, access control bypass, and unauthorized data retrieval. It is critical for users to update to the latest version to mitigate this risk.
Affected Version(s)
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution * <= 4.2.14