The vulnerability resides in the Essential Plugin Slider a SlidersPack which permits an attacker to control the filename supplied to a PHP include or require statement. This improper control (CWE‑98) enables Local File Inclusion, allowing access to arbitrary files on the web server that the plugin can read. If exploited, an attacker could read sensitive configuration files, user data, or other files that should be inaccessible, potentially enabling further compromise.

Essential Plugin Slider a SlidersPack (sliderspack-all-in-one-image-sliders) is affected for all releases from the first version through and including 2.3. Any WordPress installation that has any of these versions deployed is vulnerable.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the plugin’s file inclusion functionality, where an attacker may supply a crafted filename parameter to read arbitrary local files from the server. Given the nature of Local File Inclusion, it is inferred that initial compromise requires remote access to the WordPress REST API or a similar endpoint of the vulnerable plugin, and privilege escalation may follow if files such as wp-config.php can be accessed.