Edge-Themes Edge CPT plugin allows an attacker to control the filename passed to a PHP include/require statement, enabling Local File Inclusion. If an attacker can supply a malicious path, the server may read or execute arbitrary local files, which could result in disclosure of sensitive data or remote code execution. This flaw is classified as CWE-98.

WordPress installations running Edge CPT plugin version 1.4 or earlier are vulnerable. The affected product is the Edge CPT plugin by Edge-Themes, applicable to all WordPress sites that have not upgraded past version 1.4.

The CVSS score of 8.1 indicates a high severity, yet the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers could exploit the flaw by manipulating the file path parameter used by the plugin, typically through a crafted URL or form input. No special privileges are required beyond the ability to trigger the plugin’s include logic, so the attack vector is likely remote, delivered through the web interface.