CVE-2025-10406 — BlindMatrix e-Commerce < 3.1 - Contributor+ LFI
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any…
Published: 2025-10-15 · CVSS: 5.5 · CVSS 3.1
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7