The vulnerability is an improper control of the filename used in an include/require statement in the WordPress Handmade Framework plugin. This flaw permits local file inclusion, classified as CWE-98, and could allow an attacker to read arbitrary files or execute code on the server, potentially compromising confidentiality, integrity, and availability of the WordPress site.

WordPress sites using the G5Theme Handmade Framework plugin, versions up to and including 3.9 are affected. No other vendors or product versions are listed as impacted.

This weakness can be exploited by supplying a crafted request that causes the plugin to include a file from the server file system. The EPSS score is below 1%, indicating a very low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, if exploited, local file inclusion can lead to arbitrary code execution or disclosure of sensitive files. The attack vector is likely through a URL parameter or form input that the plugin’s include routine processes. The absence of a CVSS score in the data suggests the severity level is not formally defined, but the potential impact warrants attention.