The flaw stems from unsanitised input that is directly used in an include or require statement in the BuilderPress plugin. A carefully crafted request can cause the plugin to include any file located on the server. This allows an attacker to read configuration files, passwords, or other sensitive data, and if the attacker can point the include to a malicious PHP file, arbitrary code execution on the web server may result. The weakness aligns with CWE‑98: Improper Control of Filename for Include/Require Statement.

The vulnerability is present in all installations of the ThimPress BuilderPress WordPress plugin up to and including version 2.0.1. The affected product is the BuilderPress plugin for WordPress, supplied by ThimPress.

The CVSS score is not listed, but the EPSS rating indicates a probability of exploitation of less than 1 %. The issue is not currently included in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector is a remote user sending a crafted HTTP request that triggers the vulnerable include path, which can be performed without authentication. Although the exploit probability is low, the impact could be severe if the attacker gains access to confidential files or achieves code execution.