This vulnerability is a Local File Inclusion flaw caused by improper control of file names in the include/require statements of the BeeTeam368 Extensions plugin. An attacker can supply crafted input to include arbitrary files from the local file system, potentially leading to the execution of arbitrary PHP code or disclosure of sensitive content. The weakness is identified as CWE-98.

The flaw affects all installations of the BeeTeam368 Extensions WordPress plugin version 1.9.4 and earlier. The vulnerable component is the plugin code that handles file inclusion based on user-supplied parameters. No specific operating system or platform requirements are mentioned, but the vulnerability exists in any WordPress deployment using a vulnerable plugin version.

The CVSS score of 10.0 indicates a critical severity. The EPSS score is reported as less than 1%, implying a low probability of exploitation in the near term, but the high severity still warrants urgent attention. The vulnerability is not listed in the CISA KEV catalog, meaning no known active exploits have been reported yet. The likely attack vector is a web request that manipulates the include path, such as a specially crafted URL or form submission. If an attacker succeeds, they can read arbitrary files, potentially execute arbitrary code, and compromise the entire WordPress site.