prodigycommerce vulnerabilities and threats

Prodigy Commerce WordPress plugin versions up to 3.3.0 contain a critical Local File Inclusion vulnerability via the 'parameters[template_name]' parameter. This flaw allows unauthenticated attackers to include and read arbitrary files or execute arbitrary PHP code on the server. Exploitation can lead to bypassing access controls, disclosure of sensitive information, or full remote code execution. The vulnerability is identified as CWE-98 and has a CVSS v3.1 score of 9.8, indicating critical severity. No official patch or remediation information is currently available.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows DOM-Based XSS.This issue affects Prodigy Commerce: from n/a through <= 3.0.8.

Missing Authorization vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prodigy Commerce: from n/a through <= 3.1.2.