The vulnerability is an improper control of filename for include/require statements in PHP within the Edge CPT plugin. An attacker can supply a crafted file path that the plugin will include, allowing access to sensitive files stored on the web server, such as configuration files, credentials, or source code. If the included file is tampered with, this can lead to arbitrary code execution and compromise the entire WordPress site.

The affected product is the Edge CPT plugin from Edge-Themes, specifically versions up through 1.4. Any WordPress installation using this plugin, regardless of the WordPress core version, is at risk.

The CVSS score of 8.1 indicates a high severity vulnerability that could allow remote persistence, data disclosure, or code execution. The EPSS score of less than 1% suggests that exploitation attempts are currently low. The plugin does not currently appear in the CISA KEV catalog. The likely attack vector is a web-based request that provides a malicious filename parameter to the plugin’s include logic, enabling the attacker to fetch arbitrary local files.