The vulnerability is a local file inclusion flaw in the Post Slides WordPress plugin, caused by the plugin not validating certain shortcode attributes before using them to build file paths for include functions. This allows authenticated contributors or higher to cause the plugin to read arbitrary files on the server, exposing sensitive configuration data or credentials. The weakness falls under CWE‑22.

The affected product is the Post Slides WordPress plugin version 1.0.1 or earlier. The plugin is distributed without a vendor name in the CNA data, so any site running the vulnerable version is at risk.

The CVSS score of 5.5 denotes a moderate severity, and the EPSS score of <1% indicates a low current exploitation likelihood. The flaw can be exploited by any authenticated user with a contributor role or higher by supplying specially crafted shortcode attributes that are not validated, allowing the plugin to include arbitrary files via the include functions. While the vulnerability is not listed in the CISA KEV catalog, the fact that contributors are common in many installations means remediation should be prioritized.