The identified vulnerability is a Local File Inclusion flaw in the GravityWP Merge Tags plugin. Improper control of the filename supplied to a PHP include/require statement allows an attacker to read any file on the server, potentially executing arbitrary code. This results in a loss of confidentiality and integrity with the possibility of full Remote Code Execution.

GravityWP’s Merge Tags plugin for WordPress. All installations of the plugin with a version of 1.4.4 or earlier are impacted. No specific starting version was provided, so any version up to and including 1.4.4 is considered vulnerable.

The CVSS score of 7.5 indicates a high severity vulnerability, with the EPSS score below 1% reflecting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the web interface, since the plugin processes input from request parameters that control the file path. Because the flaw arises from unsanitized user input, an attacker could craft a request to include arbitrary files, potentially triggering code execution if PHP files are read.