The vulnerability is an improper control of filename for an include/require statement in PHP, allowing Local File Inclusion. An attacker who can influence the include path may read arbitrary local files or execute files, leading to disclosure of sensitive information or remote code execution. The weakness is identified as CWE-98.

The affected product is InfornWeb News & Blog Designer Pack, a WordPress plugin. Versions from the initial release up through 4.0 are impacted. Users running any affected version should verify their installed plugin version.

The CVSS score of 8.1 indicates a high severity, reflecting the potential for significant impact. The EPSS score of less than 1% shows a low estimated likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a web request that manipulates the include parameter, so an attacker needs either local access or an ability to craft a request against the plugin. Prompt patching is recommended to mitigate the risk.