Elated‑Themes Laurent Core plugins exhibit a flaw where filenames supplied to PHP include/require statements are not properly validated. The result is a Local File Inclusion vulnerability that permits an attacker to read or execute local files on the web server. This can compromise confidential data or lead to arbitrary code execution, thereby affecting the confidentiality and integrity of the affected system.

Elated‑Themes Laurent Core plugin is affected in all released versions up to and including 2.4.1. Any WordPress installation that has the Laurent Core plugin <= 2.4.1 is at risk.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% signals a low known exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a Local File Inclusion via the plugin’s include logic, which requires an attacker to insert a crafted request that resolves to a local path (such as a log file or PHP source). No explicit authentication requirement is stated, so the path may be usable by unauthenticated users or users with basic access to the site, but further exploitation to achieve code execution would likely need elevated privileges.