The flaw is improperly controlling the filename used in an include/require statement, which can allow untrusted input to point to arbitrary local files. An attacker who can influence the include path may read or execute code from the server, leading to compromised confidentiality, integrity, or availability. This is a classic PHP LFI that can be escalated to remote code execution via crafted local files.

The vulnerable plugin is ThimPress WP Pipes, versions up to and including 1.4.3, deployed on WordPress installations. The plugin is distributed for WordPress, and any site using WP Pipes prior to 1.4.3 is affected.

The CVSS score is 8.1, indicating high severity. The EPSS score is less than 1%, so exploitation likelihood is low but non-zero. The vulnerability is not listed in CISA KEV. Attackers would need to supply a crafted request to the plugin’s include parameter, which is presumably accessible via a public URL. If the plugin is exposed to the Internet, the LFI can be exploited remotely.