The NasaCore plugin for WordPress contains an improper control over the filename used in PHP include/require statements. The flaw allows an attacker to manipulate the path of an included file and include arbitrary files from the server. Successful exploitation could enable the attacker to read sensitive files, or if writable files are included, execute injected code, leading to full compromise of the site.

This issue affects all releases of NasaCore from the first public version up to and including 6.4.4. The plugin is a WordPress component maintained by NasaTheme and is identified in the CVE as NasaTheme:Nasa Core. Systems running the plugin on any WordPress installation with a version <= 6.4.4 are vulnerable.

The vulnerability carries a CVSS v3 score of 7.5, indicating high severity, but the EPSS score is below 1%, suggesting a low current likelihood of exploitation. It is not listed in CISA's KEV catalog. Potential attackers would likely use the web interface to supply a crafted query that influences the include path. While local file inclusion is the primary impact, an attacker could also achieve remote code execution if the included file is writable.