Limited Local File Inclusion in MultiVendorX Plugin for WooCommerce by WordPress
CVE-2025-0493
9.8CRITICAL
Key Information:
- Vendor
- WordPress
- Vendor
- CVE Published:
- 31 January 2025
Summary
The MultiVendorX plugin, designed for WooCommerce environments, is susceptible to a Local File Inclusion vulnerability through the 'tabname' parameter. This flaw enables unauthenticated attackers to include arbitrary PHP files stored on the server, leading to potential code execution, access control bypass, and unauthorized data retrieval. It is critical for users to update to the latest version to mitigate this risk.
Affected Version(s)
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution * <= 4.2.14
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Michael Mazzolini