A Local File Inclusion flaw in the Hide My WP Ghost plugin for WordPress allows an attacker to read arbitrary files on the server and subsequently execute PHP code, leading to full control of the affected web environment. The vulnerability is a classic CWE‑98 issue involving improper validation of filenames used in PHP include or require statements. If successfully exploited, confidential data could be disclosed, the server could be compromised, and the website’s integrity and availability would be threatened.

The issue impacts the WordPress plugin Hide My WP Ghost developed by John Darrel, affecting all releases from the initial version up through 5.4.01. WordPress sites running any of these versions are vulnerable.

The CVSS score of 9.6 indicates a critical threat, but the EPSS score of less than 1% suggests the likelihood of widespread exploitation remains low at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the attacker is able to influence the include path parameter, which typically occurs via crafted requests that manipulate user input or via local privilege escalation. Once the file is included, arbitrary PHP execution can be achieved, making the vulnerability essentially a remote code execution vector.