The vulnerability arises from an improper control of the filename used in PHP include/require statements within the Post Grid Master ajax-filter-posts functionality. This flaw permits an attacker to cause the plugin to include locally stored files when a crafted request is made. The inclusion can expose sensitive server files or enable execution of malicious code, potentially leading to data disclosure or local code execution on the web server. The weakness maps to CWE‑706 and CWE‑98.

The vulnerability affects the WordPress Post Grid Master plugin developed by Akhtarujjaman Shuvo. Any installation of this plugin from its earliest release up to and including version 3.4.12 is vulnerable. The plugin is a WordPress extension that provides AJAX‑filtered post grids. No other vendors or products are currently listed as affected.

The CVSS score is 6.5, indicating a moderate severity. The EPSS value is below 1%, suggesting that the current exploitation likelihood is very low, and the vulnerability is not listed in the CISA KEV catalogue. The LFI flaw is likely exploitable by sending a crafted request to the ajax‑filter endpoint to force the plugin to include a local file; the attacker only needs access to the vulnerable site’s URL. Because no remote file inclusion or privileged code execution is required, the attack vector is local to the web application. Organizations should treat this flaw as a moderate risk but act promptly to remediate.