A PHP Local File Inclusion flaw exists in the Zikzag Core WordPress plugin versions up to and including 1.4.5. The vulnerability arises because the plugin uses an uncontrolled filename in an include or require statement, allowing an attacker to read arbitrary files on the server or, if the attacker can place a PHP file in a readable location, execute code. This can compromise confidentiality and, if misused, lead to full system compromise through remote code execution. The weakness is characterized by CWE‑98.

WordPress sites running the WebGeniusLab Zikzag Core plugin with a version that is 1.4.5 or older are affected. The flaw is present in all releases from the beginning of the plugin up to the specified version.

The CVSS score of 8.1 classifies this as a high‑severity vulnerability. The EPSS score of <1% indicates a low probability of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is exploitation via crafted requests to the plugin, leveraging user input that is incorporated into a file inclusion path. Successful exploitation could expose sensitive files or allow the execution of attacker‑controlled PHP code, depending on file permissions and server configuration.