The vulnerability in the Subscribe to Download WordPress plugin is caused by improper control of the filename used in a PHP include/require statement, allowing an attacker to supply a crafted input that results in an arbitrary local file being included. This can expose sensitive server files and potentially enable the execution of malicious PHP code, compromising confidentiality and system integrity.

The issue affects the wpshuffle Subscribe to Download plugin for WordPress. Versions from the initial launch through and including 2.0.9 are vulnerable, so any WordPress site with this plugin installed at those versions is at risk.

The CVSS score is 7.5, indicating a high severity, while the EPSS score of <1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted request that passes a malicious filename to the plugin, allowing local file inclusion. No public exploit is documented so the risk remains largely theoretical, but the potential impact warrants timely remediation.