Shopify Plugin EUVD-2026-41304

Exploitation requires an authenticated account with at least Contributor privileges (CVSS PR:L) on a WordPress site that has the Shopify / Shopify Help Center plugin (version ≤ 1.0.0) installed and active. No user interaction is needed (UI:N), and the request is delivered over the network (AV:N), but success is gated by high attack complexity (AC:H) - implying dependence on specific path, encoding, or filesystem conditions rather than a trivial one-shot request. The key limiting factors are the Contributor authentication requirement (so sites without untrusted authors or open registration are largely protected) and the plugin's low deployment footprint; the exact vulnerable parameter and endpoint are not disclosed in the provided data.

The signals are mixed and warrant a measured priority. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) shows network reachability with no user interaction but two dampeners: high attack complexity (AC:H) and required low privileges (PR:L, i.e. an authenticated Contributor account). The full C:H/I:H/A:H triad reflects a worst-case escalation to code execution, though a pure LFI more commonly yields high confidentiality with lower integrity/availability impact - the vendor's H/H/H may be optimistic for a read-oriented LFI. No EPSS score was provided in the input, KEV status is not listed (no active exploitation), and no POC is referenced, so real-world exploitation pressure appears low today. The practical gate is that an attacker must first obtain Contributor-level access on the target WordPress site, which meaningfully limits mass exploitation and makes this most relevant to multi-author or membership sites.

An attacker registers or compromises a Contributor-level account on a WordPress site running the Shopify plugin, then sends a crafted request whose file/path parameter references a local file such as wp-config.php or a poisoned log file. Successful inclusion discloses sensitive configuration (database credentials, secret keys) and, if attacker-controlled content can be included and executed, can escalate to remote code execution. No public exploit is currently identified, and the high attack complexity means reliable exploitation likely requires specific path or environment conditions.