CVE-2025-11722: Category and Products Accordion Panel <= 1.0 - Authenticated (Contributor+) Local File Inclusion
The Woocommerce Category and Products Accordion Panel plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'categoryaccordionpanel' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11722?
CVE-2025-11722 is considered to have a high severity due to its potential for local file inclusion risks.
How do I fix CVE-2025-11722?
To fix CVE-2025-11722, you should update the Woocommerce Category and Products Accordion Panel plugin to the latest version or remove the vulnerable shortcode from your site.
Who is affected by CVE-2025-11722?
CVE-2025-11722 affects authenticated users with Contributor-level access on WordPress sites running versions of the plugin up to and including 1.0.
What can attackers do with CVE-2025-11722?
Attackers exploiting CVE-2025-11722 can potentially access sensitive files on the server by utilizing local file inclusion methods.
Is CVE-2025-11722 included in later versions of the plugin?
Yes, CVE-2025-11722 is addressed in versions of the Woocommerce Category and Products Accordion Panel plugin released after 1.0.