CVE-2025-0493
Published: 31 January 2025
Summary
CVE-2025-0493 is a critical-severity Path Traversal (CWE-22) vulnerability in Multivendorx Multivendorx. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0493 is a Limited Local File Inclusion vulnerability (CWE-22) affecting the MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress in all versions up to and including 4.2.14. The flaw occurs via the 'tabname' parameter in the class-mvx-ajax.php component, enabling the inclusion of PHP files on the server and subsequent execution of PHP code within those files. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows execution of arbitrary PHP code from included files, potentially bypassing access controls, extracting sensitive data, or achieving remote code execution in scenarios where PHP file uploads are possible elsewhere on the site.
WordPress plugin trac repositories show the vulnerable code at line 661 in the 4.2.14 tag of class-mvx-ajax.php, with a fix implemented in the 4.2.15 tag at the same location. Additional details on the vulnerability, including threat intelligence, are available in the Wordfence advisory.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1716
Vulnerability details
The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclusion in all versions up to, and including, 4.2.14 via the tabname parameter. This makes it possible for unauthenticated attackers to include…
more
PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated exploitation of a public-facing WordPress plugin via LFI leading to arbitrary PHP code execution/RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2025-0493 by requiring timely remediation of the known flaw through patching the MultiVendorX plugin to version 4.2.15 or later.
Requires validation and sanitization of the untrusted 'tabname' parameter to block path traversal attacks enabling local file inclusion and PHP code execution.
Deploys boundary protections such as web application firewalls to inspect and block malicious requests targeting the vulnerable 'tabname' parameter in class-mvx-ajax.php.