The My auctions allegro plugin for WordPress allows an attacker to include and execute arbitrary files on the server through the unvalidated 'controller' parameter. This local file inclusion flaw can be exploited by unauthenticated users to run PHP code, bypass access controls, and exfiltrate sensitive data. The impact is full code execution on the affected host, granting attackers control over the system and the ability to compromise the entire WordPress installation.

The vulnerability affects the WordPress plugin "My auctions allegro" from the vendor wphocus, versions 3.6.32 and earlier. Only WordPress sites that have this plugin installed are at risk.

The flaw carries a CVSS score of 8.1, indicating high severity, but the EPSS score is below 1%, suggesting a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by sending a crafted HTTP request containing a malicious value for the 'controller' parameter; no authentication is required. Successful exploitation results in execution of arbitrary PHP code, enabling full compromise of the WordPress site.