The vulnerability is an improper control of filename for include/require statements in PHP, allowing local file inclusion in the WordPress Subscribe to Download Lite plugin. An attacker can manipulate file paths used by the plugin to read sensitive files from the server, potentially exposing configuration files, passwords, or other confidential data. The flaw is a classic example of CWE‑98: Improper Control of Filename for Include/Require Statement.

The issue affects the WP Shuffle Subscribe to Download Lite WordPress plugin, versions from the earliest release through version 1.2.9. No later releases are listed as impacted. It is specifically the plugin supplied by WP Shuffle, which installs into WordPress sites.

This vulnerability has a CVSS score of 7.5, indicating a high severity. The EPSS score is 2%, suggesting a very low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely attempt to exploit the LFI by supplying crafted input to the plugin’s file include functionality; the exact trigger point is not documented, but the nature of the flaw implies it can be activated via user-supplied parameters. The risk remains significant for any website using a vulnerable version of the plugin, as compromised files could lead to further compromise.