The Fable Extra plugin contains code that uses PHP include or require statements without validating the filename supplied by a user. This flaw allows an attacker to specify an arbitrary file path, leading to local file inclusion. The vulnerability can reveal sensitive configuration data or, if the attacker can supply PHP code, execute arbitrary code within the WordPress environment. The weakness corresponds to CWE-98, representing improper control of filename.

WordPress installations that have the Fable Extra plugin from version 1.0.6 and earlier are affected. The plugin is distributed via the official WordPress Plugin Repository and is used by many sites, so any site running a vulnerable version is at risk.

The CVSS score of 9.8 indicates critical severity, whereas the EPSS score of <1 % suggests that exploitation is currently rare but still possible. It is inferred that an attacker would need web access to the site and the ability to influence the include path, typically through an unauthenticated or authenticated request to the plugin’s frontend or an exposed parameter. The issue is not listed in the CISA KEV catalog. Because local file inclusion can be leveraged to read sensitive files or execute arbitrary code if the attacker can place or tamper with PHP files, the risk of data disclosure or remote code execution remains high.