High · published October 15, 2025
⚡ An authenticated attacker can execute arbitrary .php files on your server through a single shortcode! The Woocommerce Category and Products Accordion Panel plugin is the culprit, with all versions up to 1.0 vulnerable! 🔥 Think of it like a restaurant where only certain staff can access the kitchen, but a crafty contributor finds a way to slip in a note that commands the chef to prepare anything! This Local File Inclusion flaw lets them execute any PHP script they desire, opening the door to a world of mischief. If exploited, attackers can bypass access controls completely, potentially leaking sensitive data or even executing malicious scripts on your server. This could lead to devastating scenarios such as unauthorized data access or complete server takeover, putting your entire site and user data at risk!
Think of it like a restaurant where only certain staff can access the kitchen, but a crafty contributor finds a way to slip in a note that commands the chef to prepare anything! This Local File Inclusion flaw lets them execute any PHP script they desire, opening the door to a world of mischief. The vulnerability stems from the 'categoryaccordionpanel' shortcode, allowing authenticated users with Contributor-level access and higher to include and execute arbitrary .php files on the server, leading to remote code execution and access control bypassing.
If exploited, attackers can bypass access controls completely, potentially leaking sensitive data or even executing malicious scripts on your server. This could lead to devastating scenarios such as unauthorized data access or complete server takeover, putting your entire site and user data at risk! Immediately update the Woocommerce Category and Products Accordion Panel plugin to version 1.0.1 or later to patch this vulnerability. Additionally, review user roles and limit access to only those who absolutely need it—no need for unauthorized contributors to have kitchen access! You've got this! By taking these steps, you'll secure your site and keep those sneaky attackers at bay. 🛡️