Local File Inclusion Vulnerability in Product Category Slider for WooCommerce by PluginEver
CVE-2025-39364

7.5HIGH

Key Information:

Vendor

WordPress
Status
Product Category Slider For WooCommerce
Vendor
CVE Published:
19 May 2025

What is CVE-2025-39364?

The Product Category Slider for WooCommerce plugin by PluginEver is susceptible to a Local File Inclusion (LFI) vulnerability due to improper management of filename controls in PHP include/require statements. This flaw enables potential attackers to manipulate the PHP scripts on the server, leading to unauthorized access to sensitive files. The vulnerability affects versions of the Product Category Slider for WooCommerce up to and including 4.3.4, highlighting the necessity for users to promptly update to the latest secure version to mitigate risks.

Affected Version(s)

Product Category Slider for WooCommerce <= 4.3.4

References

https://patchstack.com/database/wordpress/plugin/woo-cate...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha (Patchstack Alliance)
.