The vulnerability is an Improper Control of Filename for Include/Require Statement in PHP, allowing a Local File Inclusion attack in the Greenly Theme Addons plugin of WordPress. This flaw corresponds to CWE-98 and can enable an attacker to include arbitrary files from the server, potentially exposing sensitive data or executing malicious code under the web server’s permission. The impact therefore spans from compromised confidentiality to complete code execution, depending on the files that can be targeted.

Affected product: Creatives_Planet Greenly Theme Addons. All versions from the initial release up to, but not including, version 8.2 are vulnerable. Any installation using Greenly Theme Addons less than 8.2 is potentially exposed.

The CVSS score of 7.5 indicates a high severity level. The EPSS score is less than 1%, suggesting that the likelihood of exploitation observed in the wild is low at present, and it is not listed in the CISA KEV catalog. However, the attack vector is inferred as a local inclusion triggered via input parameters handled by the plugin; an attacker might need some level of authenticated access or ability to influence the inclusion path, but could also be exploited by publicly accessible URLs if the plugin does not properly sanitize input. Given the high potential impact, it is recommended to address the flaw promptly.