The vulnerability disclosed in the Academist Core WordPress plugin allows an attacker to control the filename used in a PHP include/require statement. This uncontrolled inclusion can read sensitive files, such as configuration or credentials, or if a suitable file containing executable code is provided, can lead to remote code execution. The weakness is classified as CWE-98, representing improper control of filename for include/require operations.

The defect affects the Elated‑Themes Academist Core plugin for WordPress, specifically all releases from the initial version up to and including 1.4.1. WordPress sites that have any of these versions installed are susceptible to exploitation.

The CVSS score of 8.1 indicates a high severity flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Typical exploitation would involve an attacker supplying a crafted request that triggers the plugin to include an arbitrary file path, which is likely achievable through a public URL or an input field that accepts a filename. Successful exploitation could allow the attacker to read arbitrary files or execute arbitrary PHP code, thereby compromising the confidentiality, integrity, and availability of the affected WordPress installation.