CVE-2025-60204

Name of the Vulnerable Software and Affected Versions WooCommerce Store Toolkit versions prior to 2.4.4

Description The WooCommerce Store Toolkit plugin for WordPress contains a Local File Inclusion issue. This occurs due to improper control of filenames used in include or require statements within the PHP program. Unauthenticated attackers can exploit this to include and execute arbitrary files on the server, potentially leading to the execution of PHP code. This flaw can be used to bypass access controls or obtain sensitive data, particularly when images or other safe file types are uploaded and subsequently included.

Recommendations Update WooCommerce Store Toolkit to a version newer than 2.4.3.