Issuu Panel is a WordPress plugin that processes AJAX requests through ajax-docs.php. In versions prior to 1.6.6 the code accepts an "abspath" GET parameter and passes it directly to PHP's require() function, creating a file inclusion flaw (CWE-98). This allows a remote or local file to be included, giving an attacker the ability to execute arbitrary PHP code or read sensitive files. The vulnerability therefore permits unauthenticated remote code execution on any WordPress site using a vulnerable instance of the plugin.

Any WordPress installation that has the Issuu Panel plugin installed with a version earlier than 1.6.6 is affected. The attack can be carried out by sending a crafted GET request to menu/documento/requests/ajax-docs.php with an abspath value pointing to a remote or local file, regardless of the user's authentication level.

The vulnerability has a CVSS score of 9.2, indicating a high likelihood of significant impact. The EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can target the plugin from any network accessible to the site, and exploitation requires no special privilege or valid credentials. Based on the description, the attack vector is inferred to be a remote network-based request that supplies a malicious abspath parameter.