The vulnerability resides in the Hub Core plugin for WordPress and allows an attacker to control the filename used in a PHP include or require statement. This flaw, classified as CWE-98, can enable the reading or execution of arbitrary files on the server, which may lead to disclosure of sensitive data or execution of malicious code if a PHP file is read from a controlled or remote source.

WordPress sites that have installed the LiquidThemes Hub Core plugin version 5.0.8 or earlier are affected. No specific minor version is listed beyond the upper bound of 5.0.8, and the issue applies to all installations from the initial release to that version.

The CVSS score of 7.5 indicates a high impact if the vulnerability is exploited. The EPSS score of less than 1% suggests a low probability of exploitation in the wild at this time, and the vulnerability is not currently catalogued in the CISA KEV list. The likely attack vector is web-based, where a remote attacker could supply a crafted request to induce the plugin to include a local or remote file and gain sensitive information or control over the site.