The Tiny Bootstrap Elements Light plugin for WordPress contains a Local File Inclusion flaw (CWE-98) that allows an attacker to specify an arbitrary "language" parameter and include any PHP file from the server. This can result in executing arbitrary PHP code, bypassing access controls, accessing sensitive data, or fully compromising the WordPress site. The flaw exists in all versions up to and including 4.3.34 and does not require authentication, making it particularly dangerous.

Any WordPress installation that has the Tiny Bootstrap Elements Light plugin version 4.3.34 or earlier installed is affected. The vulnerability is triggered by the "language" parameter present in the plugin’s bootstrap-label.php script, which all users can reach via normal site URLs.

The CVSS score of 8.1 reflects a high severity impact, though the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, but unauthenticated attackers can exploit it by crafting a request to the vulnerable parameter, potentially achieving code execution if they can upload or otherwise provide PHP content that the server will include. The lack of authentication requirements expands the potential attacker base, warranting immediate attention.