The LT Unleashed WordPress plugin is vulnerable to Local File Inclusion through the 'template' parameter in the 'book' shortcode when its value is not properly sanitized. The flaw allows authenticated users with Contributor-level access or higher to specify file paths that the plugin will include and execute as PHP code. If an attacker includes sensitive files such as wp-config.php, they can obtain credentials and gain broader control over the site. This vulnerability is classified as CWE‑98. The CVSS score of 7.5 indicates high severity, and the EPSS score of less than 1% reflects a low probability of widespread exploitation at present, but it still represents a serious risk to the affected installations.

LT Unleashed plugin for WordPress, versions up to and including 1.1.1

The vulnerability requires valid contributor or higher credentials to exploit, which limits the attacker’s ability to reach the system unimpeded. Once authenticated, an attacker can craft a shortcode containing a malicious path in the 'template' parameter, forcing the plugin to include arbitrary files and execute them as PHP. The high CVSS score signals significant impact on confidentiality, integrity, and availability. Because EPSS is below 1% and the vulnerability is not listed in CISA’s KEV catalog, it is currently considered a low likelihood of exploitation, yet the potential for code execution warrants urgent attention.