Executive brief
A vulnerability exists in the Shopify plugin for WordPress, which is used to integrate e-commerce functionality into WordPress websites. An attacker with contributor-level access can exploit this flaw to view sensitive internal files on the web server. This could lead to the exposure of database credentials or other configuration secrets, potentially resulting in a full site takeover.
Technical details
The Shopify plugin for WordPress (versions up to and including 1.0.0) contains a Local File Inclusion (LFI) vulnerability, classified as CWE-98. The flaw resides in the improper control of filenames for include or require statements in PHP. An attacker with 'Contributor' or higher privileges can manipulate input to include local files from the server's filesystem. This can be used to read sensitive files like wp-config.php, which contains database credentials. The attack requires network access and authenticated privileges, with a high complexity (AC:H) noted in the CVSS vector. As of the advisory date, no official patch is available.
Affected products
- Shopify Help Center Shopify Plugin <= 1.0.0
Timeline
- 2025-10-15: other: Reported by Rafie Muhammad
- 2026-07-02: advisory: Published by Patchstack
- 2026-07-02: disclosed: NVD Published Date