The News and Blog Designer Bundle plugin for WordPress permits unauthenticated local file inclusion through the template parameter in all releases up to and including 1.1. By providing a crafted value, an attacker can cause the server to include and execute arbitrary .php files located on the filesystem. This allows the adversary to run any PHP code, effectively bypassing access controls, reading sensitive data, or executing arbitrary commands within the web server context.

The vulnerability affects the WordPress News and Blog Designer Bundle plugin, specifically versions 1.1 and below. Any site running these versions and leaving the template parameter exposed is at risk.

With a CVSS score of 9.8, the flaw is considered critical. The EPSS score of less than 1% indicates that while exploit attempts are rare, the high severity makes discovery and exploitation still a substantial threat. It is not listed in the CISA KEV catalog. The attack vector is inferred to be local file inclusion via the template parameter, allowing any unauthenticated user to direct the plugin to include files on the server, leading to remote code execution if PHP files can be uploaded or accessed.