The vulnerability is an improper control of the filename for an include/require statement in PHP, allowing local file inclusion. An attacker could supply a malicious file path and cause the plugin to read or execute arbitrary files on the web server, potentially exposing sensitive configuration data or compromising the site. The weakness is classified as CWE‑98.

RadiusTheme’s Testimonial Slider And Showcase Pro plugin for WordPress, affecting all installations running any version up to and including 2.3.15. This includes any WordPress site that has the plugin activated and accessible to unauthenticated or authenticated users who can influence the file path parameter.

The CVSS score of 8.1 indicates high severity, while the EPSS score of 2% indicates a non‑negligible current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation. The likely attack vector is through a crafted request to the plugin’s file path parameter, enabling the attacker to read arbitrary local files. Without additional access, this does not directly lead to remote code execution, but it can disclose critical information that could be leveraged for further attacks.