Local File Inclusion Vulnerability in Woocommerce Category and Products Accordion Panel for WordPress

CVE-2025-11722

What is CVE-2025-11722?

The Woocommerce Category and Products Accordion Panel plugin for WordPress is affected by a Local File Inclusion vulnerability that allows authenticated attackers, possessing Contributor-level access or higher, to include and execute arbitrary PHP files on the server. Exploiting this issue enables the execution of malicious PHP code, which could lead to unauthorized access, data leakage, or compromise of the entire web application. The vulnerability exploits the 'categoryaccordionpanel' shortcode in version 1.0 and below, allowing a potential bypass of access controls with the inclusion of arbitrary .php files.

References