This vulnerability is an instance of CWE-98, improper control of the filename used in PHP include/require statements within the TangibleWP Listivo Core plugin. The flaw permits an attacker to trigger a PHP Local File Inclusion (LFI). An LFI can expose arbitrary files stored on the web server, potentially revealing configuration data or other sensitive material.

The affected product is TangibleWP Listivo Core. All releases with version numbers up to and including 2.3.77 are vulnerable. No specific component is singled out in the advisory.

The CVSS score of 8.1 indicates high severity. The EPSS score is below 1%, showing a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves manipulation of a filename parameter that is passed directly to an include or require call; the attacker may trigger the flaw through crafted URLs or inputs via the plugin interface. While the LFI itself does not provide remote code execution, it can allow sensitive data disclosure, and in environments where arbitrary files can be uploaded or where execution of included files is possible, it could be a stepping stone to further compromise.