What is the CVSS score of CVE-2026-57748?

CVE-2026-57748 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Shopify Plugin are affected by CVE-2026-57748?

The Shopify Help Center WordPress plugin (versions through 1.0.0) contains a file-inclusion vulnerability allowing authenticated contributors to read sensitive server files and potentially execute…

How to fix or mitigate CVE-2026-57748?

Within 24 hours: Audit all WordPress installations for this plugin's presence and identify active contributor accounts. Within 7 days: Either disable the plugin or implement Contributor role assignment restrictions to essential users only; enable file-access logging and monitoring. Within 30 days: Subscribe to Patchstack and the plugin vendor's security channels for patch availability; conduct comprehensive audit of server file-access logs since plugin deployment to detect unauthorized reads.

Shopify Plugin CVE-2026-57748

EUVD-2026-41304 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-02 Patchstack

GHSA-48gx-7j8f-rc33

PHP WordPress Information Disclosure LFI Wordpress Plugin Shopify

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Contributor auth gives PR:L and disclosed AC:H stands; primary impact is file-read confidentiality (C:H) with only secondary integrity/availability (I:L/A:L) absent confirmed RCE.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:25 vuln.today

DescriptionCVE.org

Contributor Local File Inclusion in Shopify <= 1.0.0 versions.

AnalysisAI

Local File Inclusion in the Shopify (Shopify Help Center) WordPress plugin through version 1.0.0 allows an authenticated user with at least Contributor privileges to include and read arbitrary local files on the server, potentially escalating to code execution via CWE-98-style file-inclusion abuse. The flaw was reported by Patchstack and carries a CVSS 7.5 rating driven by high confidentiality, integrity, and availability impact but with high attack complexity. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a PHP-based WordPress plugin identified by the CPE cpe:2.3:a:shopify_help_center:shopify (the 'Shopify' / Shopify Help Center plugin), not the Shopify SaaS e-commerce platform itself - this distinction matters for triage. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP), meaning user-influenced input reaches a PHP include/require call. In WordPress plugins this typically manifests as a page/template/path parameter that is concatenated into an include() without adequate sanitization or an allow-list, letting an attacker traverse the filesystem to pull local files (and, under CWE-98's remote-file-inclusion semantics, potentially load attacker-controlled content that PHP then executes).

RemediationAI

No vendor-released patch identified at time of analysis, since version 1.0.0 is both the latest and the affected release. Until a fixed version is published, the most reliable action is to deactivate and remove the Shopify (Shopify Help Center) plugin, accepting the loss of its help-center functionality. If removal is not acceptable, restrict who can reach the vulnerable code path by tightening user roles so untrusted accounts do not hold the Contributor capability, disable open user registration, and place a WAF virtual-patch/rule in front of the plugin's request parameters to block path-traversal sequences (e.g. '../', null bytes, and absolute paths) - noting that WAF rules can be bypassed and may break legitimate requests. Monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/shopify-plugin/vulnerability/wordpress-shopify-plugin-1-0-0-local-file-inclusion-vulnerability?_s_id=cve) for a patched release and upgrade as soon as one is available.