The MultiVendorX WooCommerce Multivendor Marketplace plugin suffers from a CWE-22 path traversal vulnerability via the 'tabname' parameter, enabling limited local file inclusion. This allows unauthenticated attackers to include and execute arbitrary PHP files on the server. The vulnerability affects all versions up to 4.2.14 and can lead to full compromise through code execution, data disclosure, and access control bypass. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical impact and ease of exploitation. No patch or vendor advisory is currently available, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation can lead to remote code execution, unauthorized access to sensitive data, and bypass of access controls on affected WordPress sites using the vulnerable MultiVendorX plugin. The vulnerability is exploitable without authentication and requires low attack complexity, making it highly impactful. There are no known exploits in the wild yet, but the critical CVSS score indicates a severe risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin version to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available. Avoid uploading PHP files to the server or restrict upload capabilities to trusted users only.