The vulnerability resides in CMSMasters Content Composer where an attacker may supply a crafted filename to an include/require statement in the plugin’s PHP code. This flaw permits the inclusion of arbitrary local files, enabling the reading of sensitive data on the server and, in contexts where executable PHP files can be placed locally, the execution of arbitrary code. The impact is primarily on confidentiality and integrity of the system’s files, and could lead to a full compromise of the affected WordPress site if the attacker can upload or alter local PHP scripts.

CMSMasters Content Composer plugin versions older than 2.5.7 are affected. The flaw is present in all releases prior to 2.5.7, with no specific sub‑versions listed for remediation.

The CVSS score is 8.1, indicating a high severity. The EPSS score is below 1 %, suggesting that current exploitation activity is low, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local: an attacker with the ability to craft a request to the vulnerable plugin or to supply a file path that bypasses validation can trigger the include. Because the flaw is within a plugin on a WordPress installation, a successful exploit could allow reading of configuration files, database credentials or other sensitive data, and potentially lead to full server compromise.