The Ultimate Classified Listings plugin is vulnerable to local file inclusion through the uclwp_dashboard shortcode. This vulnerability is a CWE-98 Local File Inclusion flaw. An attacker who has authenticated Contributor-level or higher access can specify any file path that points to a PHP file on the server and have that file included and executed. Because the included code runs with the permissions of the WordPress process, the attacker can bypass existing access controls, read sensitive files, and execute arbitrary PHP, effectively giving code‑execution capabilities on the host.

All installations of Ultimate Classified Listings for WordPress with versions up to and including 1.6 are impacted. The plugin is distributed by WebCodingPlace and can be found on the WordPress plugin repository. No other versions are listed as affected, but any environment running these vulnerable versions will be susceptible.

The vulnerability carries a CVSS score of 7.5, indicating high severity, but the EPSS score is below 1 %, suggesting a low but non‑zero likelihood of exploitation at the time of this analysis. It is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with Contributor privileges and the ability to insert the malicious shortcode or modify an existing one. Once the attacker provides a file path that points to a PHP file on the server, the code inside that file is executed in the context of the WordPress site, allowing the attacker full access to the underlying file system as the web‑server user.