CVE-2025-60248

Name of the Vulnerable Software and Affected Versions WPC Product Options for WooCommerce versions prior to 3.1.3

Description The plugin contains a Local File Inclusion issue, which occurs when an application includes a file without properly validating the input, allowing an attacker to read or execute files on the server. Authenticated attackers with subscriber-level access and above can include and execute arbitrary files, potentially leading to the execution of PHP code. This flaw can be used to bypass access controls or obtain sensitive data, especially if images or other file types can be uploaded and subsequently included.

Recommendations Update WPC Product Options for WooCommerce to version 3.1.3 or later.