The vulnerability resides in the Hub Core plugin for WordPress and results from improper control of the filename used in a PHP include or require statement. Classified as CWE-98, this flaw permits an attacker to read or execute arbitrary local files on the server. The effect may include disclosure of sensitive data or execution of malicious code if a PHP file is included from a crafted request.

WordPress sites that have installed the LiquidThemes Hub Core plugin version 5.0.8 or earlier are affected. No specific minor version is listed beyond the upper bound of 5.0.8, and the issue applies to all installations from the initial release to that version.

The CVSS score of 7.5 indicates a high impact if the vulnerability is exploited. The EPSS score of less than 1% suggests a low probability of exploitation in the wild at this time, and the vulnerability is not currently catalogued in the CISA KEV list. Based on the description, it is inferred that the likely attack vector is web-based, where a remote attacker could supply a crafted request to induce the plugin to include a local or remote file and gain sensitive information or control over the site.