CVE-2025-0493
Published: 31 January 2025
Description
The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclusion in all versions up to, and including, 4.2.14 via the tabname parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included
Security Summary
CVE-2025-0493 is a Limited Local File Inclusion vulnerability (CWE-22) affecting the MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress in all versions up to and including 4.2.14. The flaw occurs via the 'tabname' parameter in the class-mvx-ajax.php component, enabling the inclusion of PHP files on the server and subsequent execution of PHP code within those files. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows execution of arbitrary PHP code from included files, potentially bypassing access controls, extracting sensitive data, or achieving remote code execution in scenarios where PHP file uploads are possible elsewhere on the site.
WordPress plugin trac repositories show the vulnerable code at line 661 in the 4.2.14 tag of class-mvx-ajax.php, with a fix implemented in the 4.2.15 tag at the same location. Additional details on the vulnerability, including threat intelligence, are available in the Wordfence advisory.
Details
- CWE(s)