This vulnerability arises from inadequate control over the filename supplied to PHP include/require statements within the Subscribe to Download Lite plugin. The flaw, identified as CWE‑98, permits an attacker to read arbitrary files from the server’s filesystem when a crafted request is made. While the description does not mention code execution, the availability of deliberate local file reading can aid in gathering sensitive information such as configuration files or credentials.

The plugin WP Shuffle – Subscribe to Download Lite is vulnerable in all releases up to and including version 1.2.9. Versions newer than 1.2.9 are considered safe by the vendor’s version range.

A CVSS score of 7.5 denotes a high‑severity issue, and an EPSS score of <1% indicates that exploitation is currently uncommon. The vulnerability is not listed in CISA’s KEV catalog. The most probable attack vector involves a publicly accessible plugin endpoint where a specially crafted parameter can influence the file path used in the include operation. No additional constraints or privileges are required beyond initiating the request.