CVE-2025-68877
Lifecycle Timeline
2Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cedcommerce CedCommerce Integration for Good Market ced-good-market-integration allows PHP Local File Inclusion.This issue affects CedCommerce Integration for Good Market: from n/a through <= 1.0.6.
Analysis
Local file inclusion in CedCommerce Integration for Good Market WordPress plugin versions 1.0.6 and earlier allows unauthenticated attackers to read arbitrary files from the server via improper filename validation in PHP include/require statements. The vulnerability affects a popular e-commerce integration plugin used by WooCommerce merchants, exposing sensitive configuration files, database credentials, and other sensitive data accessible to the web server process. EPSS probability of 0.14% suggests low real-world exploitation likelihood despite the information disclosure impact.
Technical Context
CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) represents a class of PHP vulnerabilities where user-supplied input is passed unsanitized to include(), require(), include_once(), or require_once() functions. In this case, the CedCommerce Integration for Good Market plugin fails to properly validate or sanitize filename parameters before using them in PHP file inclusion operations, enabling local file inclusion (LFI). While the CVE title mentions 'PHP Remote File Inclusion,' the actual vulnerability is local file inclusion, allowing attackers to traverse the filesystem and access files like wp-config.php, .env files, or system configuration files. The vulnerability affects the ced-good-market-integration WordPress plugin, which provides WooCommerce integration functionality for the Good Market e-commerce platform.
Affected Products
CedCommerce Integration for Good Market (ced-good-market-integration) WordPress plugin from version 1.0.0 through version 1.0.6 is affected. This plugin is distributed via the WordPress plugin repository and is used to integrate WooCommerce stores with the Good Market e-commerce platform. The vulnerability impacts all installations of this plugin at version 1.0.6 and earlier.
Remediation
Update CedCommerce Integration for Good Market plugin to a patched version beyond 1.0.6 immediately. Site administrators should log into WordPress dashboard, navigate to Plugins, and update the ced-good-market-integration plugin to the latest available version. If a patched version is not yet available, deactivate and remove the plugin until an update is released. As a temporary workaround prior to patching, restrict access to the plugin's vulnerable endpoints via web server configuration (nginx/Apache) or WordPress security plugins if specific vulnerable URI patterns can be identified. Verify wp-config.php and .env file permissions are restricted to prevent information disclosure if the server has been compromised. See Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ced-good-market-integration/vulnerability/wordpress-cedcommerce-integration-for-good-market-plugin-1-0-6-local-file-inclusion-vulnerability for additional details and patch version when available.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today