PT-2025-42312 · WordPress · Woocommerce Category/Products Accordion Panel

Published 2025-10-15 · Updated 2025-10-15 · CVE-2025-11722

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Woocommerce Category and Products Accordion Panel plugin versions prior to 1.1

Description The Woocommerce Category and Products Accordion Panel plugin for WordPress is susceptible to Local File Inclusion. This allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary .php files on the server. Successful exploitation can lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php file uploads are permitted. The vulnerability exists due to the 'categoryaccordionpanel' shortcode.

Recommendations Update the Woocommerce Category and Products Accordion Panel plugin to version 1.1 or later.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-11722

Affected Products

Woocommerce Category/Products Accordion Panel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-11722 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/55315ba1-cbb8-4ce1-96c6-30a02611ba47?source=cve · Note
• https://t.me/CVEtracker/34989 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1978407340698157282 · Twitter Post
• https://plugins.trac.wordpress.org/browser/accordion-panel-for-category-and-products/tags/1.0/include/categoryaccordionpanel.php#L87 · Note
• https://twitter.com/CVEnew/status/1978545124541096340 · Twitter Post
• https://plugins.trac.wordpress.org/browser/accordion-panel-for-category-and-products/tags/1.0/include/abstract.php#L256 · Note