The vulnerability is an improper control of filename for include/require statements, which allows a local file inclusion (LFI) in the Subscribe to Unlock Lite plugin. If an attacker can supply a crafted path, they may be able to read sensitive files or trigger the inclusion of a malicious file, potentially leading to disclosure of confidential data. The flaw is rooted in a classic PHP include/require weakness (CWE‑98).

WP Shuffle maintains the Subscribe to Unlock Lite plugin, and every instance of the plugin with a version from n/a through 1.3.0 is affected. This includes all WordPress sites that have installed the plugin in any of those versions.

The CVSS score of 7.5 indicates substantial impact and high complexity, while the EPSS score of less than 1% suggests the probability of exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path involves an attacker identifying a vulnerable include parameter, crafting a path that traverses to a local file, and then attempting to execute or read that file. Because the flaw is a local file inclusion, it generally requires access to the web application context, but if the plugin accepts external input, an attacker may be able to abuse it remotely.