Security Flaw in BlindMatrix e-Commerce Plugin for WordPress
CVE-2025-10406
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 15 October 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-10406?
The BlindMatrix e-Commerce WordPress plugin prior to version 3.1 fails to properly validate certain shortcode attributes, which can lead to Local File Inclusion (LFI) attacks. This vulnerability allows authenticated users, such as contributors, to exploit the weakness by using malicious paths in their requests, potentially leading to unauthorized data exposure or further compromises within the server environment.
Affected Version(s)
BlindMatrix e-Commerce 0 < 3.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.