XStore | Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Lokale Datei-Inklusion

An attacker exploiting this LFI vulnerability can achieve remote code execution on the WordPress server. By crafting malicious PHP files and including them through the etajaxrequiredpluginspopup() function, an attacker can bypass access controls and execute arbitrary code. This could lead to data breaches, website defacement, or complete server compromise. The ability to upload and include .php files is a prerequisite for successful exploitation, but if present, the impact is significant. This vulnerability shares similarities with other LFI exploits where attackers leverage file inclusion to gain unauthorized access and control.

Websites using the XStore WordPress theme, particularly those with file upload functionality enabled, are at risk. Shared hosting environments where users have limited control over server configurations are also particularly vulnerable, as they may be unaware of the outdated theme version or lack the ability to perform updates.

• wordpress / composer / npm:

grep -r 'et_ajax_required_plugins_popup()' /var/www/html/wp-content/themes/xstore/

• wordpress / composer / npm:

wp plugin list | grep xstore

• wordpress / composer / npm:

find /var/www/html/wp-content/uploads/ -name '*.php' -type f

1. 2025-10-15Disclosure

   disclosure

1. Reserviert2025-10-14
2. Veröffentlicht2025-10-15
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-11746 is to immediately upgrade the XStore WordPress theme to version 9.5.5 or later. If upgrading is not immediately feasible, consider restricting file upload permissions to prevent attackers from uploading malicious PHP files. Implement a Web Application Firewall (WAF) with rules to block attempts to include arbitrary files. Monitor WordPress logs for suspicious file inclusion attempts, particularly targeting the etajaxrequiredpluginspopup() function. After upgrading, verify the fix by attempting to access a non-existent PHP file through the vulnerable function and confirming that access is denied.