The Flexi Product Slider and Grid for WooCommerce plugin allows a local file inclusion vulnerability in all releases up to and including 1.0.5. The flaw is caused by the theme attribute of the flexipsg_carousel shortcode being concatenated into a file path without sanitization or validation, enabling an authenticated user with Contributor role or higher to supply arbitrary paths. If exploited, the attacker can read or execute any PHP file present on the server, potentially compromising the integrity and confidentiality of the WordPress installation and any data it hosts.

WordPress sites running the Flexi Product Slider and Grid for WooCommerce plugin provided by wpdecent. All versions 1.0.5 or earlier are susceptible. Users of the plugin in any WordPress setup that allows contributors to create or edit posts carrying shortcodes are affected.

The vulnerability carries a CVSS score of 7.5, indicating high severity, but the EPSS score is below 1%, suggesting a low probability of exploitation at present. It is not listed in the CISA KEV catalog. Exploitation requires authenticated access at least at the contributor level and the ability to inject the flexipsg_carousel shortcode into a post. Attackers could therefore target sites where contributors have been granted posting privileges, creating a malicious post that includes the forged theme path to include and run arbitrary PHP code.