Medium severity5.5NVD Advisory· Published Oct 15, 2025· Updated Apr 15, 2026

CVE-2025-10406

Description

The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Blindmatrix E Commerceinferred
Range: <3.1
Package: https://wordpress.org/plugins/blindmatrix-e-commerce
Welcart/E Commercellm-fuzzy
Range: <3.1

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/d8bdd2d4-c03c-4e7f-9c8a-6efc010311b6/nvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000