CVE-2025-0493 is a critical (9.8) local file inclusion flaw in the MultiVendorX WooCommerce marketplace plugin for WordPress, versions up to and including 4.2.14. Update the plugin to a release newer than 4.2.14 and confirm the exact fixed version on the Wordfence entry.
What's affected
The record says the plugin, named MultiVendorX, The Ultimate WooCommerce Multivendor Marketplace Solution, is vulnerable in all versions up to and including 4.2.14. The flaw is reachable through the tabname parameter. The record says unauthenticated attackers can include PHP files on the server, which allows any PHP code in those files to run.
The WordPress plugin directory slug that appears in the references is dc-woocommerce-multi-vendor. The references link the same source file in the 4.2.14 and 4.2.15 tags, which suggests 4.2.15 is the release that changed it. I did not confirm that from the vendor's changelog, so check the Wordfence entry and the plugin changelog before you rely on it.
The weakness is CWE-22, improper limitation of a pathname to a restricted directory. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: a network attack, low complexity, no privileges, no user interaction, with high impact on confidentiality, integrity and availability. The record does not mark the flaw as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
The record also describes what inclusion could be used for: bypassing access controls, obtaining sensitive data, or achieving code execution in cases where PHP files can be uploaded and included. The word limited in the name reflects that the inclusion is restricted to PHP files, but the record still rates the result as critical.
How to check if you're exposed
If you use WP-CLI on the server, list the plugin and its version:
wp plugin list --name=dc-woocommerce-multi-vendor --fields=name,status,version
Without WP-CLI, open the Plugins page in the WordPress admin and read the version under MultiVendorX. You can also read the plugin header from disk:
grep -m1 "Version:" wp-content/plugins/dc-woocommerce-multi-vendor/dc_product_vendor.php
The main file name can differ between releases, so if that path is not found, list the folder and look at the readme. Any version at or below 4.2.14 is in scope, whether the plugin is active or only installed. Check staging and old copies too.
Then check the web server logs for requests that carry a tabname value you do not recognise. Normal use should pass only the tab names the plugin itself uses.
What to do now
- Find every WordPress site that has the plugin, including staging sites and old backups restored somewhere.
- Take a backup, then update to the latest release. With WP-CLI:
wp plugin update dc-woocommerce-multi-vendor. - Confirm the version afterwards is higher than 4.2.14, and compare it to the fixed version named by Wordfence.
- If you cannot update at once, deactivate and remove the plugin, or block public access to the marketplace endpoints until you can.
- Check for unexpected PHP files in upload folders, since the record notes that inclusion plus an uploaded PHP file can lead to code execution.
- If you saw suspicious requests, rotate admin passwords and keys, and review recently changed files.
Why it matters
An include statement that builds its path from request input is a classic path handling mistake. The code should map a short list of allowed names to fixed files, and reject everything else. When it does not, the attacker chooses which PHP file the server loads.
Marketplace plugins are attractive targets because they handle vendors, orders and payouts on public sites. An unauthenticated flaw means anyone on the internet can reach it, which is why the score is so high.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a fix available?
The record covers versions up to and including 4.2.14, and the references point to a 4.2.15 tag. Confirm the fixed version on the Wordfence entry and in the plugin changelog.
Does a deactivated plugin still matter?
Yes, if its files remain on disk. Remove the plugin completely if you do not use it.
Sources
- NVD record for CVE-2025-0493
- Gold vulnerability page
- Wordfence vulnerability entry
- Plugin source, tag 4.2.15
Last reviewed: 19 October 2026.
