The vulnerability arises from improper control of filenames used in PHP include and require statements within the Gutenify plugin. An attacker can supply crafted input that causes the plugin to include local files. This local file inclusion can enable the attacker to read arbitrary files on the server, and if PHP files can be injected and executed, it may lead to remote code execution. The weakness is classified as CWE-98.

The affected product is the CodeYatri Gutenify WordPress plugin. Versions up to and including 1.5.4 are vulnerable. No specific sub-versions within that range are listed, so all earlier releases are considered affected until the fix is applied.

The CVSS score of 7.5 indicates a high impact severity. An EPSS score of less than 1% shows that the likelihood of exploitation is currently low, and the vulnerability is not present in the CISA KEV catalog. The likely attack vector is through a manipulated request to the plugin that triggers the include logic; however, the precise path and parameters are not disclosed in the CVE data, so this inference is drawn from the nature of the flaw and typical LFI exploitation scenarios.