The SportsPress plugin for WordPress contains a Local File Inclusion flaw in all versions up to and including 2.7.26. By supplying a specially crafted value to the shortcode attribute 'template_name', attackers with contributor-level or higher permissions can include arbitrary files from the server’s filesystem and execute PHP code in those files. This vulnerability permits bypassing the normal WordPress access controls, exposing sensitive configuration data, and achieving remote code execution when the target file is under the attacker's control.

WordPress sites running the SportsPress – Sports Club & League Manager plugin at versions 2.7.26 or earlier. The plugin is provided by the vendor ThemeBoy and is widely used in community clubs and league websites.

The flaw carries a CVSS score of 8.8 and an EPSS score of less than 1%, indicating a high severity but a low probability of exploitation as measured by current threat data. It is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the contributor level or higher, and the attacker must supply a malicious 'template_name' value via a post or comment containing the shortcode. Once included, the file is executed in the context of the web server, enabling full code execution on the host.