Improper control of filename in an include or require statement within the Testimonial Slider plugin allows an attacker to specify arbitrary file paths. By supplying a crafted filename, the plugin can read any accessible local file; if that file contains PHP code, the code will execute under the web server’s user context, potentially granting full system compromise. This issue is classified as CWE‑98, Improper Control of Filename for Include/Require Statements, and is a classic Local File Inclusion flaw that directly threatens confidentiality, integrity, and availability.

The flaw affects the Testimonial Slider plugin developed by PluginOps. All releases from the initial version up through version 3.5.8.6 are impacted. No other vendors or products are explicitly listed in the advisory.

The CVSS score of 8.8 indicates a high severity for this vulnerability. The EPSS score of less than 1% suggests that the likelihood of public exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is local in nature, likely triggered through the plugin’s web interface where the filename parameter can be supplied by a remote user. Because the flaw resides in server‑side PHP code, an attacker that can reach the affected plugin’s endpoint can potentially include local files and achieve remote code execution if exploited successfully.