EUVD-2025-17238
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fahad Mahmood WP Shopify allows PHP Local File Inclusion. This issue affects WP Shopify: from n/a through 1.5.3.
Analysis
PHP Local File Inclusion (LFI) vulnerability in the WP Shopify plugin (versions up to 1.5.3) that allows authenticated attackers to include and execute arbitrary local files on the web server through improper control of filename parameters in PHP include/require statements. The vulnerability requires low-privilege user access (PR:L) and has moderate attack complexity (AC:H), but results in complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making it a significant risk for WordPress sites using this plugin.
Technical Context
This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP-specific weakness where user-controlled input is passed unsanitized to include(), require(), include_once(), or require_once() functions without proper validation or sanitization. The WP Shopify plugin fails to properly validate or restrict the filename parameter before using it in a PHP inclusion statement, enabling attackers to traverse the filesystem and include sensitive files (e.g., /etc/passwd, wp-config.php containing database credentials, or other plugin files). The CPE identifier would be: cpe:2.3:a:fahad_mahmood:wp_shopify:*:*:*:*:*:wordpress:*:* (versions 1.5.3 and below). This differs from RFI (Remote File Inclusion) in that it is restricted to local files accessible to the web server process, but the impact remains severe as WordPress installations typically contain sensitive configuration files.
Affected Products
WP Shopify (1.5.3 and earlier (all versions from initial release through 1.5.3))
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today