The PublishPress Authors plugin contains a flaw where the filename used in PHP include/require statements is not properly controlled. This improper handling allows an attacker to influence which local file is included, potentially leading to execution of arbitrary code on the server. The flaw is a CWE‑98: Improper Control of Filename for Include/Require Statement. The severity rating of 7.5 reflects the high impact due to code execution capability and widespread availability of the plugin.

The vulnerability is present in all released versions of the PublishPress Authors plugin up through 4.7.5. Any WordPress site that has this plugin installed and has not upgraded beyond version 4.7.5 is affected.

The CVSS score of 7.5 indicates a high risk, while the EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. The weakness type is CWE‑98, which can allow an attacker to include arbitrary local files by manipulating user input or crafted requests to the plugin's endpoint. The lack of a public list of exploits further implies that this vulnerability may be challenging to exploit in a real-world scenario.