CVE-2025-60189

Name of the Vulnerable Software and Affected Versions PoloPag – Pix Automático para Woocommerce versions prior to 2.1.0

Description The plugin contains a Local File Inclusion issue, which occurs when an application includes a file without properly validating the input, allowing an attacker to manipulate the path to include files from the local server. This allows unauthenticated attackers to include and execute arbitrary files on the server, potentially leading to the execution of PHP code. This flaw can be used to bypass access controls or obtain sensitive data, especially if images or other safe file types can be uploaded and subsequently included.

Recommendations Update PoloPag – Pix Automático para Woocommerce to a version newer than 2.0.9.