{"id":55323,"date":"2025-06-27T04:08:54","date_gmt":"2025-06-27T04:08:54","guid":{"rendered":""},"modified":"2025-10-02T00:14:48","modified_gmt":"2025-10-02T06:14:48","slug":"cve-2025-4200-critical-local-file-inclusion-vulnerability-in-zagg-electronics-accessories-woocommerce-wordpress-theme","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-4200-critical-local-file-inclusion-vulnerability-in-zagg-electronics-accessories-woocommerce-wordpress-theme\/","title":{"rendered":"<strong>CVE-2025-4200: Critical Local File Inclusion Vulnerability in Zagg &#8211; Electronics &#038; Accessories WooCommerce WordPress Theme<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>CVE-2025-4200 is a severe vulnerability in the WooCommerce WordPress Theme &#8220;Zagg &#8211; Electronics &#038; Accessories&#8221; that can lead to significant security breaches if properly exploited. The threat impacts all versions up to, and including, 1.4.1, and leaves WordPress sites prone to unauthorized remote file inclusion and execution. As WordPress powers a substantial portion of the web, this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-49847-buffer-overflow-vulnerability-in-llama-cpp-leading-to-potential-code-execution\/\"  data-wpil-monitor-id=\"62629\">vulnerability could potentially<\/a> affect a large number of sites and, by extension, their visitors.<br \/>\nThe importance of <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-58280-object-heap-address-exposure-vulnerability-in-ark-ets\/\"  data-wpil-monitor-id=\"87311\">addressing this vulnerability<\/a> cannot be understated. Not only does it pose a threat to the integrity and confidentiality of affected WordPress sites, but it can also lead to the violation of user privacy, <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-5868-critical-vulnerability-in-rt-thread-leading-to-system-compromise-and-data-leakage\/\"  data-wpil-monitor-id=\"63879\">system compromise<\/a>, or data leakage. The <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-6172-high-severity-permission-vulnerability-in-mobile-applications\/\"  data-wpil-monitor-id=\"61742\">severity of the vulnerability<\/a>, coupled with the potential scale of its impact, demands immediate attention.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2025-4200<br \/>\nSeverity: Critical (8.1 CVSS Score)<br \/>\nAttack Vector: Network<br \/>\nPrivileges Required: None<br \/>\nUser Interaction: None<br \/>\nImpact: <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-6435-firefox-vulnerability-leading-to-potential-system-compromise-and-data-leakage\/\"  data-wpil-monitor-id=\"65817\">System compromise<\/a>, data leakage<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-2167544637\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 700px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 20px; font-weight: 600; display: flex; align-items: center;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 8px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 40px; height: 40px;\" \/>\r\n    <\/a>\r\n    A new way to communicate\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 12px;\">\r\n    Ameeba Chat is built on encrypted identity, not personal profiles.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 16px;\">\r\n    Message, call, share files, and coordinate with identities kept separate.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 20px;\">\r\n    <li>\u2022 Encrypted identity<\/li>\r\n    <li>\u2022 Ameeba Chat authenticates access<\/li>\r\n    <li>\u2022 Aliases and categories<\/li>\r\n    <li>\u2022 End-to-end encrypted chat, calls, and files<\/li>\r\n    <li>\u2022 Secure notes for sensitive information<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px;\">\r\n    Private communication, rethought.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Download Ameeba Chat<\/a>\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Learn More<\/a>\r\n  <\/div>\r\n<\/div>\r\n<\/div>\n<p>Product | Affected Versions<\/p>\n<p>Zagg &#8211; Electronics &#038; Accessories <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-25998-php-remote-file-inclusion-vulnerability-in-samex-woocommerce-wordpress-theme\/\"  data-wpil-monitor-id=\"65816\">WooCommerce WordPress<\/a> Theme | Up to and including 1.4.1<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>CVE-2025-4200 exploits the load_view() function in the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-28947-critical-php-remote-file-inclusion-vulnerability-in-mbstore-digital-woocommerce-wordpress-theme\/\"  data-wpil-monitor-id=\"65854\">WooCommerce WordPress<\/a> Theme, &#8220;Zagg &#8211; Electronics &#038; Accessories,&#8221; which is called via at least three AJAX actions: &#8216;load_more_post&#8217;, &#8216;load_shop&#8217;, and &#8216;load_more_product. The <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-47164-code-execution-vulnerability-in-microsoft-office-via-use-after-free-error\/\"  data-wpil-monitor-id=\"61847\">vulnerability allows unauthenticated attackers to include and execute<\/a> arbitrary files on the server.<br \/>\nThis essentially means that any PHP code in those files will be executed, bypassing access controls, and potentially <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-49181-unauthorized-api-endpoint-access-leading-to-denial-of-service-and-data-leakage\/\"  data-wpil-monitor-id=\"61695\">leading to unauthorized access to sensitive data<\/a> or system compromise. The vulnerability is particularly dangerous because it can be exploited to execute code in cases where images and other &#8220;safe&#8221; <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-47167-microsoft-office-type-confusion-vulnerability-leading-to-unauthorized-local-code-execution\/\"  data-wpil-monitor-id=\"61760\">file<\/a> types can be included and uploaded.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-1027918722\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>Here is a conceptual example of how an attacker might exploit this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-6001-cross-site-request-forgery-vulnerability-in-virtuemart-product-image-upload-function\/\"  data-wpil-monitor-id=\"62164\">vulnerability using a malicious AJAX request:<\/a><\/p>\n<pre><code class=\"\" data-line=\"\">POST \/wp-admin\/admin-ajax.php HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/x-www-form-urlencoded\naction=load_more_post&amp;file_path=..\/..\/..\/..\/wp-config.php<\/code><\/pre>\n<p>In this example, the attacker is attempting to load the &#8216;wp-config.php&#8217; file, which contains <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-6560-sapido-wireless-routers-exposure-of-sensitive-information-vulnerability\/\"  data-wpil-monitor-id=\"64468\">sensitive information<\/a> like database credentials. This is achieved by using the &#8216;load_more_post&#8217; AJAX action and <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-53964-critical-file-manipulation-vulnerability-in-goldendict\/\"  data-wpil-monitor-id=\"67129\">manipulating the &#8216;file_path&#8217; parameter to navigate to the target file<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview CVE-2025-4200 is a severe vulnerability in the WooCommerce WordPress Theme &#8220;Zagg &#8211; Electronics &#038; Accessories&#8221; that can lead to significant security breaches if properly exploited. The threat impacts all versions up to, and including, 1.4.1, and leaves WordPress sites prone to unauthorized remote file inclusion and execution. As WordPress powers a substantial portion of [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-55323","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/55323","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=55323"}],"version-history":[{"count":12,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/55323\/revisions"}],"predecessor-version":[{"id":80142,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/55323\/revisions\/80142"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=55323"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=55323"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=55323"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=55323"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=55323"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=55323"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=55323"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=55323"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=55323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}