The flaw exists in the wpWax Logo Showcase Ultimate plugin, where user‑supplied file names are passed directly to a PHP include/require statement without sanitization. This improper control of filenames allows a Local File Inclusion. If an attacker can supply a path to a local file, the site may expose sensitive files or, if they can write PHP code to the webroot, achieve remote code execution. The weakness is classified as CWE‑98 and is rated with a CVSS score of 6.5, indicating moderate severity.

WordPress installations that have the Logo Showcase Ultimate plugin version 1.4.4 or earlier are affected. The plugin is developed by wpWax. All installations of the plugin with a version of 1.4.4 or lower are vulnerable; newer releases are not known to contain the flaw.

The EPSS score of less than 1 % indicates that exploitation popularity is currently low, and the issue is not listed in the CISA KEV catalog. However, the potential impact of reading arbitrary files or injecting malicious code means the risk is non‑trivial. Based on the description, the likely attack vector is via crafted HTTP requests to the plugin’s exposed endpoints, which do not require special privileges beyond the ability to send requests to the site.