The MediaPress plugin performs a PHP include/require using a filename derived from user-controlled input without proper validation, which permits an attacker to read arbitrary files from the web server. The flaw can expose sensitive configuration data, credentials, or other secrets, and may provide a foothold for further exploitation if the included file is writable or contains executable PHP code. This vulnerability is classified under CWE‑98.

BuddyDev MediaPress versions from the earliest available release through 1.5.9.1 are affected. Any WordPress site that has not upgraded past 1.5.9.1 and still uses MediaPress is at risk. No earlier version cutoff is specified, so all installations of 1.5.9.1 or earlier should be considered vulnerable.

The CVSS score of 7.5 places this case in the high severity range. The EPSS score below 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation is known. The most likely attack vector would involve a crafted HTTP request that triggers the unvalidated include call; based on the description, this inference is made rather than explicitly stated in the source material.