The Breaking News WP plugin suffers a Local File Inclusion (LFI) flaw that allows an authenticated user with Subscriber or higher access to supply a directory traversal payload. By manipulating the brnwp_theme option through the brnwp_ajax_form endpoint— which lacks both authorization checks and CSRF protection— an attacker can override the option value to a traversal string such as ../../../../etc/passwd and force the shortcode handler to include that file. The resulting data exposure is confined to the server file system and does not give direct code execution but does compromise confidentiality. This vulnerability is classified as CWE‑22, Local File Inclusion.

WordPress sites running the Breaking News WP plugin version 1.3 or earlier are affected. The plugin is listed under the vendor doctorwp for the product Breaking News WP. No other software versions are presently affected by this issue.

The CVSS score of 6.5 places this flaw in the medium severity range. Exploitability is moderate because the attacker must be authenticated at the Subscriber level and must supply a path traversal string, yet no additional conditions such as network exposure or privilege escalation are required. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that no widely known exploits have been observed. An attacker could exploit the flaw by sending a crafted AJAX request to the brnwp_ajax_form endpoint and then viewing the resulting page that renders the malicious shortcode. The lack of CSRF checks makes the attack straightforward for anyone with site credentials.