CVE Database /
CVE-2025-30999
CVE · High
CVE-2025-30999 — External Store for Shopify [wp-shopify] < 1.6.0
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-30999
|
External Store for Shopify [wp-shopify] < 1.6.0 |
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') |
High
7.5
|
< 1.6.0
|
1.6.0 |
2025-06-05 |
—
|
CVE-2025-30999
The WP Shopify plugin for WordPress contains a security flaw that allows attackers with contributor-level access and above to inject arbitrary server-side files into the application's workflow. This vulnerability enables malicious users to bypass standard access controls, potentially extract sensitive data, or execute custom code by uploading and incorporating "safe" file types such as images.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings