Critical · published January 31, 2025
🚨 Shockingly simple! A mere tweak to the tabname parameter in the MultiVendorX plugin for WordPress could let attackers grab any PHP file on the server — no authentication needed! 🔥 Think of the MultiVendorX plugin like a restaurant's back kitchen. If an attacker merely asks the server for a dish by name, yet can sneakily request any recipe — they could end up cooking up something disastrous! 🍽️ An attacker could exploit this vulnerability to include malicious PHP files, gaining full control over your server. This means they can bypass access controls, steal sensitive data, or execute any code they wish — a scenario that could lead to devastating consequences for your business and data integrity!
Think of the MultiVendorX plugin like a restaurant's back kitchen. If an attacker merely asks the server for a dish by name, yet can sneakily request any recipe — they could end up cooking up something disastrous! 🍽️ This Local File Inclusion (LFI) vulnerability in versions up to 4.2.14 of the MultiVendorX plugin allows unauthenticated users to include arbitrary PHP files by manipulating the tabname parameter, leading to unauthorized code execution.
An attacker could exploit this vulnerability to include malicious PHP files, gaining full control over your server. This means they can bypass access controls, steal sensitive data, or execute any code they wish — a scenario that could lead to devastating consequences for your business and data integrity! To protect your site, update the MultiVendorX plugin to version 4.2.15 or later immediately. Additionally, consider implementing strict input validation on parameters like tabname to avoid similar vulnerabilities in the future. 🛡️ You've got this! Follow these steps, and you'll have your site locked down and secure in no time! 💪🎉