This vulnerability in the CTUsers WordPress plugin allows an attacker to control the filename used in a PHP include/require statement. By manipulating the input used by the plugin, an attacker can cause the application to include arbitrary local files. The result can be the disclosure of sensitive data such as configuration files, or in the worst case, the execution of arbitrary code if the included file contains executable PHP code. The weakness is classified as CWE‑98.

The CTUsers plugin from Case‑Themes, version 1.0.0 and any earlier release is vulnerable. Systems running WordPress with this plugin installed and not upgraded to a later version are affected.

The CVSS score of 7.5 marks this flaw as a high severity vulnerability. Its EPSS score of less than 1 % indicates a low probability of exploitation at this time, but because the flaw can lead to code execution or sensitive data leakage, it remains a critical concern. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector involves the web interface of the plugin, where an attacker supplies a crafted filename parameter to trigger the inclusion of a local file.