The Visual Portfolio, Photo Gallery & Post Grid plugin contains an improper handling of file names supplied in PHP include/require statements. An attacker can supply a crafted path that causes the server to read or execute files from the local filesystem. This flaw can lead to the disclosure of sensitive data or arbitrary code execution within the context of the WordPress site, compromising confidentiality and integrity.

Any WordPress installation that has the Visual Portfolio, Photo Gallery & Post Grid plugin installed and running a version through 3.5.1 is impacted. The flaw exists in all releases from the plugin’s earliest public version up to and including 3.5.1.

The severity score of 7.5 classifies the issue as high. No public exploits have been documented at the time of writing. The likely attack vector is through a publicly accessible interface or administrative setting that accepts file path input, allowing an attacker to trigger the inclusion of malicious or sensitive files. Full exploitation requires the attacker to have write or read access to the site’s file system path specified by the plugin’s code.