The Aisle Core plugin contains an improper control of filenames used in PHP include/require statements, which permits local file inclusion. This error allows an attacker to read arbitrary files on the server; if the included file contains malicious code, the attacker could achieve remote code execution or exfiltrate sensitive data, compromising confidentiality, integrity, and availability.

Any WordPress site that has installed Elated-Themes The Aisle Core plugin version 2.0.5 or earlier is affected. No other vendors or products are indicated in the records.

The CVSS score of 8.1 classifies the flaw as high severity, while the EPSS score of less than 1 percent indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation reports. The likely attack vector is a remote request that supplies a crafted file path to the plugin’s inclusion point; the description does not specify the exact parameter but infers that manipulating the filename used by the plugin would trigger the inclusion. Because the flaw can lead to RCE if an attacker can inject code, the overall risk remains significant despite the low current exploitation probability.