Improper control of filename for include/require statements in the UDesign Core plugin allows an attacker to force the inclusion of arbitrary local files through crafted input. The vulnerability, categorized as CWE–98, can lead to the disclosure of sensitive files or execution of arbitrary PHP code if the included file contains malicious content. In the worst case, successful exploitation could provide a full compromise of the web application server.

The security issue affects AndonDesign UDesign Core from the earliest available release through version 4.14.0. All installations of the plugin at or below this version are vulnerable.

The CVSS score of 7.5 classifies the vulnerability as high severity, and the EPSS score of less than 1 % indicates it is currently unlikely to be actively exploited. The exploit would likely require sending a specially crafted HTTP request to the plugin’s file inclusion endpoint, potentially exploiting authenticated or unauthenticated access depending on how the plugin validates input. Because the vulnerability is not listed in the CISA KEV catalog, no known widespread exploitation has been documented as of the latest assessment.