The vulnerability is a path traversal flaw that permits local file inclusion in the List category posts plugin, allowing an attacker to specify a crafted path that resolves to an arbitrary file on the server. If the included file contains PHP code, the attacker could execute code with the privileges of the web server process. Even if only read access occurs, sensitive configuration files or source code may be exposed. The weakness is identified as CWE-35.

The List category posts plugin developed by Fernando Briano, version 0.91.0 or earlier, is affected. The plugin operates within a WordPress installation and is exposed through the plugin’s public face to HTTP requests.

The CVSS score of 7.5 indicates moderate to high severity, but the EPSS score of less than 1% shows a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, yet the attack scenario requires web access to the plugin’s endpoint and an attacker’s ability to supply a crafted URL parameter. The local file inclusion can potentially grant code execution or information disclosure depending on how the server handles PHP includes and directory traversal input.