MultiVendorX WooCommerce Multivendor Marketplace Limited Local File Inclusion Vulnerability

A limited local file inclusion vulnerability has been identified in the MultiVendorX - The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress, affecting all versions through 4.2.14. The vulnerability arises from the 'tabname' parameter, allowing unauthenticated attackers to include PHP files from the server. This could lead to the execution of arbitrary PHP code, potentially bypassing access controls, accessing sensitive information, or executing code in scenarios where PHP files can be uploaded and included.

Impact

Exploitation of this vulnerability could allow for unauthorized file inclusion, leading to the execution of malicious PHP code on the server. This could be used to bypass access controls, access sensitive data, or execute code in cases where uploaded PHP files can be included.

Reproduction

The vulnerability can be reproduced by sending a request to the WordPress site with the 'tabname' parameter set to a value that includes a path to a PHP file on the server. This can be done using a tool like Burp Suite or by manually crafting the request. Once the file is included, any PHP code within it will be executed on the server.

Remediation

Users are advised to update the MultiVendorX - WooCommerce Multivendor Marketplace Solution plugin to version 4.2.15 or later.