A Local File Inclusion flaw is present in WordPress Goya Core plugin versions prior to 1.0.9.4. The vulnerability allows an attacker to load arbitrary files from the server into the web context, potentially exposing sensitive configuration files, credentials, or enabling the execution of malicious code. This weakness is classified as CWE-98, which directly affects confidentiality and integrity of the affected site.

WordPress sites that use the Goya Core plugin from the Everthemess project, specifically any installation running a plugin version older than 1.0.9.4. No other vendor or product is affected by this particular LFI bug.

The CVSS score of 7.5 indicates a high severity, while EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web-based request that manipulates the plugin’s file inclusion logic; it can be exploited by an attacker with network access to the WordPress installation. The lack of audience-targeting or privilege escalation details suggests the impact is primarily local to the web application, but it can still lead to significant data exposure or further compromise.