The vulnerability stems from inadequate sanitisation of filenames used in PHP include/require statements within the Gmedia Photo Gallery plugin. An attacker can supply a crafted filename that causes the plugin to read arbitrary local files and, if the file contains PHP code, execute it. This flaw corresponds to CWE-98 and can compromise confidentiality, integrity, and availability of the affected WordPress installation, potentially giving the attacker remote code execution capabilities.

WordPress users running the Serhii Pasyuk Gmedia Photo Gallery plugin built by Grand Media, at any release from the initial version up to and including 1.23.0. No specific build numbers beyond the maximum 1.23.0 are listed as affected.

The CVSS score of 7.5 marks this as a high‑severity issue. The EPSS score of less than 1 % indicates a very low but nonzero probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the WordPress administrative or public interfaces where the plugin parses user‑supplied data. Successful exploitation would require the attacker to supply a malicious filename that resolves to a local PHP file, enabling code execution on the server.