The Prodigy Commerce WordPress plugin is vulnerable to Local File Inclusion through the 'parameters[template_name]' input. An attacker who can craft the request can cause the server to read or execute arbitrary files, enabling the execution of server‑side PHP. This permits bypassing access controls, leaking sensitive data, or running malicious code on the server, with potential full system compromise. The weakness is a classic unchecked include of an arbitrary path, identified as CWE-98.

All users of Prodigy Commerce plugin versions 3.3.0 and earlier are affected. The vulnerability exists in the core templates and shortcode handling code of the plugin. Affected versions are all releases up to and including 3.3.0; no specific patch version is supplied in the CNA data, but newer versions beyond 3.3.0 have removed the vulnerable call.

The CVSS score of 9.8 indicates critical severity, and an EPSS of 20% signals a fairly high likelihood of exploitation in the next 12‑month period. The vulnerability is not currently listed in CISA’s KEV catalog, but the high score and exploit probability warrant urgent attention. The attack vector is inferred from the description: the unauthenticated attacker can supply a crafted 'parameters[template_name]' value that points to any file on the server, such as php or configuration files, resulting in code execution. The environment must allow the request to reach the vulnerable plugin, so the trigger is remote HTTP traffic.