The vulnerability resides in the Category and Products Accordion Panel plugin for WordPress versions 1.0 and earlier, where the 'categoryaccordionpanel' shortcode can be manipulated to include local files containing PHP code. By exploiting this flaw, an attacker who can authenticate with a Contributor level or higher can gain the ability to execute arbitrary server-side code. The weakness is a Local File Inclusion flaw (CWE-98) that directly threatens confidentiality, integrity, and availability by allowing code injection, data exfiltration, or further foothold establishment.

The affected product is the Woocommerce Category and Products Accordion Panel plugin for WordPress, version 1.0 and any earlier releases. Users who have installed this plugin and granted Contributor or higher roles to users are at risk. No other vendors or products are mentioned as affected.

The CVSS score of 7.5 reflects a medium to high severity. The EPSS score of less than 1% indicates a low probability of exploitation or limited evidence of real-world attacks, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the WordPress shortcode interface, requiring the attacker to log in and add the malicious shortcode to a page or post. Once the Local File Inclusion succeeds, the attacker can execute arbitrary PHP code, potentially bypassing existing access controls and compromising the entire site.