The vulnerability is a Local File Inclusion flaw in the Category and Product Woocommerce Tabs plugin for WordPress caused by insufficient validation of the 'template' parameter within the categoryProductTab() function. An attacker who has authenticated Contributor or higher privileges can supply a crafted value for this parameter, causing the server to include and execute arbitrary PHP files. This results in potential remote code execution, data exfiltration, or modification of site content. The weakness is classified as CWE-98.

Any WordPress installation that has the Category and Product Woocommerce Tabs plugin version 1.0 or earlier installed is affected. The vulnerability applies to all sites where a user can authenticate with Contributor or higher roles. No specific WordPress core or other plugin versions are implicated beyond the presence of this plugin.

The CVSS score of 8.8 marks the flaw as high severity. The EPSS score of less than 1% indicates a low probability of exploitation in the near term, and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers would first need to authenticate to the site, then send a request containing a malicious 'template' value to the vulnerable endpoint. Because the vulnerability is localized to authenticated users, overall risk is moderate to high for sites that retain Contributor or higher roles for potentially untrusted staff.