WordPress North, a plugin from fuelthemes, has an Improper Control of Filename flaw (CWE‑98) that allows an attacker to specify an arbitrary local file for inclusion, potentially exposing sensitive files or allowing execution of PHP code and thereby compromising the site’s confidentiality and integrity.

The North - Required Plugin from fuelthemes is vulnerable for all released versions up to and including 1.4.2; versions beyond 1.4.2 are not reported as affected.

The CVSS score of 7.5 indicates a high severity, while the EPSS value of less than 1 % suggests the exploit likelihood is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a web request that triggers the plugin’s include mechanism, and while the flaw relies on local file paths, an attacker must be able to influence the path or inject a local file; therefore the attack surface is limited to sites that have the vulnerable plugin installed and expose the path parameter to an untrusted user.