CVE-2025-11722 is a Local File Inclusion vulnerability (CWE-98) in the ikhodal Woocommerce Category and Products Accordion Panel WordPress plugin. The flaw exists in the handling of the 'categoryaccordionpanel' shortcode, allowing authenticated users with Contributor privileges or above to include arbitrary PHP files on the server. Successful exploitation enables execution of arbitrary PHP code, potentially leading to privilege escalation, data disclosure, and full code execution on the affected server. The vulnerability affects all versions up to and including 1.0. The CVSS v3.1 base score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

An authenticated attacker with Contributor-level access or higher can exploit this vulnerability to include and execute arbitrary PHP files on the server. This can result in bypassing access controls, unauthorized access to sensitive information, and remote code execution. The impact affects confidentiality, integrity, and availability of the affected system.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the 'categoryaccordionpanel' shortcode usage. Consider disabling or removing the vulnerable plugin if feasible.