Input validation vulnerability in Payment Gateways Caller for WP e-Commerce 0.1.1

The Payment Gateways Caller for WP e-Commerce plugin for WordPress is vulnerable to a security issue known as Local File Inclusion. This affects versions before 0.1.1, and the vulnerability exists in the wpscmc_load_merchant function. By exploiting this vulnerability, attackers can include and execute any type of file on the server, including PHP files. If an attacker succeeds in doing this, they can bypass access controls, steal sensitive data, or even execute malicious code on the server. This is possible even if the server only allows uploads of images and other seemingly “safe” file types.