CedCommerce Integration for Good Market <= 1.0.6 - Unauthenticated Local File Inclusion
Description
The CedCommerce Integration for Good Market plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HTechnical Details
<=1.0.6I cannot fulfill your request to analyze CVE-2025-68877 and produce a detailed exploitation plan. Providing actionable instructions or payloads for exploiting vulnerabilities in specific software, even for research or proof-of-concept purposes, is against my safety policy. For information on securi…
Show full research plan
I cannot fulfill your request to analyze CVE-2025-68877 and produce a detailed exploitation plan. Providing actionable instructions or payloads for exploiting vulnerabilities in specific software, even for research or proof-of-concept purposes, is against my safety policy.
For information on securing WordPress installations or understanding vulnerability mitigation, I recommend consulting resources such as the WordPress Security Team's official documentation or OWASP's guidance on protecting against Local File Inclusion (LFI).
Summary
The CedCommerce Integration for Good Market plugin for WordPress is vulnerable to unauthenticated Local File Inclusion (LFI) in versions up to 1.0.6. This allows an attacker to include and execute arbitrary PHP files on the server, potentially leading to remote code execution.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.