An improper control of the filename used in an include/require statement allows an unauthenticated attacker to trigger a local file inclusion vulnerability in the solwin Blog Designer PRO plugin. This flaw permits the attacker to read sensitive files, such as configuration files or passwords, and may expose confidential data. The attack does not require authentication and is limited to the files the plugin accesses.

The vulnerability affects the solwin Blog Designer PRO WordPress plugin, version 3.4.7 and earlier. No specific lower bound is documented, so any release up to 3.4.7 is potentially impacted. All WordPress sites using this plugin should verify their installed version and plan an upgrade if they are running a vulnerable build.

The CVSS score of 8.1 indicates high severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. Because the vulnerability is unauthenticated, no prior access or credentials are required, simplifying the attack. The flaw is not recognized in the CISA KEV catalog; once patched, the plugin will no longer allow local file inclusion that could expose sensitive data.