Improper control of filename for include or require statements in the WordPress Subscribe to Unlock Lite plugin allows local file inclusion. Based on the description, it is inferred that this could enable an attacker to read sensitive files or execute code stored on the server. The vulnerability is identified as CWE-98 and can lead to full compromise of the affected WordPress site if the attacker uploads malicious content and then triggers the include path. Based on the description, it is inferred that the impact spans confidentiality, integrity, and availability of the website and its data.

The vulnerability affects the WordPress Subscribe to Unlock Lite plugin by WP Shuffle, specifically all installed versions up to and including 1.3.0. No other vendors or products are listed as affected.

With a CVSS score of 7.5, the vulnerability is considered high severity. However, the EPSS score is 2 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low to very low likelihood of widespread exploitation. The likely attack vector is through the website’s request handling where unvalidated path parameters are passed to an include or require statement, allowing the attacker to control the path of a local file.