CVE-2025-11722

Name of the Vulnerable Software and Affected Versions Woocommerce Category and Products Accordion Panel plugin versions prior to 1.1

Description The Woocommerce Category and Products Accordion Panel plugin for WordPress is susceptible to Local File Inclusion. This allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary .php files on the server. Successful exploitation can lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php file uploads are permitted. The vulnerability exists due to the 'categoryaccordionpanel' shortcode.

Recommendations Update the Woocommerce Category and Products Accordion Panel plugin to version 1.1 or later.