The vulnerability stems from improper validation of user input that controls the filename used in PHP include/require statements. An attacker who can manipulate the inclusion path can read arbitrary files on the server and, if the included file contains executable PHP code, may gain the ability to run arbitrary code. Such ability compromises the confidentiality of sensitive data and could also enable changes to server configuration or content integrity.

The flaw exists in the RadiusTheme Classified Listing WordPress plugin for all releases up to and including version 4.2.0. Any WordPress site that has this plugin installed and not upgraded beyond the affected threshold is potentially exposed.

The CVSS score of 7.5 indicates a high severity local file inclusion flaw. The EPSS score of less than 1 % signals that, while exploitation is possible, it is currently very unlikely to be widely observed. The vulnerability is not listed in the CISA KEV catalog. Likely remediation requires a crafted HTTP request to a plugin endpoint where the filename parameter is unsanitized, making remote exploitation feasible from the web. No special system compromise is required beyond access to the vulnerable web application.