The LearnPress Export Import plugin for WordPress contains an improper control of the filename used in a PHP include/require statement, allowing attackers to include arbitrary local files. This issue is classified as CWE-98, reflecting improper control of file names. This Local File Inclusion flaw can lead to disclosure of sensitive files or potential code execution when the included file contains executable code. The vulnerability originates from unsanitized user input processed by the import functionality.

All users running the LearnPress Export Import plugin version 4.1.2 or earlier are affected. This includes versions down to the first release (n/a) up through and including 4.1.2.

The CVSS score of 7.5 indicates a high severity with potential for exploitation. The EPSS score is < 1%, suggesting a low likelihood of being actively exploited at present. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. The most likely attack vector is to send a crafted URL to the plugin’s import endpoint, which the plugin processes without validating the filename. As the data does not specify authentication requirements or other prerequisites, it is inferred that a local or authenticated user could trigger the inclusion.