CVE Alert: CVE-2025-11722 – ikhodal – Woocommerce Category and Products Accordion Panel

**Risk verdict**: High risk of authenticated local file inclusion leading to PHP code execution, with no active exploitation indicated at present.

**Why this matters**: An attacker with Contributor+ access can include arbitrary PHP files on the server, potentially bypassing controls and reading or modifying data. In a WordPress e-commerce context, this can lead to payment data exposure, site defacement, or complete server compromise if further code execution is achieved.

**Most likely attack path**: Requires authenticated access at Contributor level or above (PR:L), with no user interaction (UI:N). The attacker leverages the shortcode parameter to trigger LFI, enabling inclusion of server-side PHP files and resulting in full code execution (C/H I/H A/H). The scope is user-level and local to the hosting environment, but successful compromise can enable lateral movement within the site if the PHP code interacts with other components.

**Who is most exposed**: WordPress sites using this plugin, especially stores with contributor/admin workflows and shared hosting where multiple editors have access. Sites allowing shortcode-based content or file uploads elevate exposure risk.

**Detection ideas**:

• Logs show requests manipulating the categoryaccordionpanel shortcode or PHP include attempts.
• Unusual PHP execution events or errors referencing included files in the plugin path.
• Abnormal file read/write activity around plugin directories.
• Repeated 500s or code execution traces following shortcode usage.

**Mitigation and prioritisation**:

• Apply available patch or upgrade beyond 1.0; if unavailable, disable the plugin.
• Enforce least-privilege for all contributors; revoke unnecessary editor capabilities.
• Implement WAF/IPS rules to detect LFI patterns; block suspicious shortcode parameters.
• Enable file integrity monitoring around plugin and PHP include paths.
• Change-management: test in staging before rollout; monitor for post-patch anomalies.