The Category and Product Woocommerce Tabs plugin for WordPress versions up to and including 1.0 contains a Local File Inclusion (LFI) vulnerability. This flaw arises from insufficient input validation on the 'template' parameter within the categoryProductTab() function. Authenticated users with contributor-level access or higher can exploit this vulnerability to include and execute arbitrary PHP files on the server, potentially leading to full system compromise.