The Abuse of the Abtest WordPress plugin allows an unauthenticated attacker to manipulate the action parameter in abtest_admin.php, causing the plugin to include files from the admin directory or other locations. By sending a crafted GET request, the attacker can load any accessible file and execute arbitrary code on the server, thereby compromising confidentiality, integrity, and availability.

Any WordPress site that has installed the Abtest plugin is vulnerable. The flaw resides in the plugin’s management script abtest_admin.php, and no specific version limits are listed, so all currently distributed releases are potentially impacted until an official fix arrives.

With a CVSS score of 6.9 the flaw is rated high severity. The EPSS score is not available, so exploitation likelihood cannot be quantified, and it is not listed in the CISA KEV catalog. The attack vector is remote and does not require credentials; an attacker only needs to send a malicious URL to abtest_admin.php with an altered action value. The plugin then resolves the path internally and executes the included file, granting full code execution on the affected host.