The vulnerability is a local file inclusion flaw located in callback.php of the WordPress Brandfolder plugin version 3.0 and earlier. By manipulating the wp_abspath parameter, attackers can include arbitrary files on the server, potentially reading sensitive data such as wp-config.php or executing remote code if a remote URL is supplied. This flaw can be exploited by unauthenticated users through direct HTTP requests.

The affected product is the Brandfolder WordPress plugin developed by Brandfolder, specifically versions 3.0 and earlier.

With a CVSS score of 6.9, this issue is rated as a moderate risk but its impact is severe due to the possibility of remote code execution. The EPSS score is < 1%, indicating a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA KEV. The likely attack vector is a simple unauthenticated direct request to the callback.php endpoint, manipulating the wp_abspath parameter to traverse directories or reference remote URLs. Given the existence of public exploits, the threat level to any unpatched deployment remains high.