WooCommerce Accordion Panel CVE-2025-11722

Exploitation requires an authenticated WordPress account with Contributor-level privileges or higher (per CVSS PR:L) and the ability to render the 'categoryaccordionpanel' shortcode, which that role can do. The plugin 'Woocommerce Category and Products Accordion Panel' (versions ≤ 1.0) must be installed and active. Local File Inclusion of arbitrary existing .php files is possible under these conditions; however, escalation to arbitrary code execution additionally requires that an attacker-controlled .php file can be placed on the server (the description scopes RCE to 'cases where .php file types can be uploaded and included'). Limiting factors: the authentication requirement (no anonymous access), the need to stage an includable PHP file for full RCE (reflected as AC:H), and dependence on sites that actually grant untrusted Contributor accounts - single-administrator installations face substantially lower practical risk.

This is a moderate-priority issue rather than a top-tier emergency, and the signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, C:H/I:H/A:H) scores 7.5 (High): remotely reachable but gated by two meaningful factors - authentication at Contributor level (PR:L) and high attack complexity (AC:H), reflecting that full code execution requires the additional ability to get a .php file onto the server to then include. The CWE-98 (PHP file inclusion) mapping and the trac references to the vulnerable include logic corroborate the LFI mechanism. EPSS is low at 0.61% (48th percentile), there is no CISA KEV listing, and no public exploit is referenced, so there is no evidence of active or widespread exploitation. The primary caveat: impact is rated C:H/I:H/A:H, which assumes the LFI can be chained to execute attacker-controlled PHP - the description explicitly notes code execution occurs 'in cases where .php file types can be uploaded and included,' so on sites that do not permit PHP upload the realistic impact is closer to local file disclosure than full RCE. Risk is therefore real for multi-author WooCommerce sites where untrusted Contributor accounts exist, but modest for single-admin deployments.

An attacker who holds (or registers/phishes their way into) a Contributor-level account on a WordPress site running this plugin embeds the 'categoryaccordionpanel' shortcode with a crafted path parameter to force the plugin to include a local .php file. By first uploading a PHP payload (e.g., disguised in the media/uploads directory) and then including it via the shortcode, they execute arbitrary PHP in the site's context. No public proof-of-concept is referenced at the time of analysis, and the high attack complexity reflects the need to stage an includable PHP file.