The vulnerability is an improper control of filenames in the PHP include/require statement used by SeedProd Pro. An attacker can supply a crafted path to a plugin endpoint, causing the application to include an arbitrary local file. This flaw can expose confidential files or, if the file contains executable PHP code, lead to remote code execution. The weakness aligns with CWE-98 and is classified as a Local File Inclusion (LFI).

SeedProd LLC SeedProd Pro is impacted for all releases prior to version 6.19.5. The affected product is the WordPress plugin SeedProd Pro, and any WordPress site that has installed a version older than 6.19.5 is vulnerable. No specific sub‑versions are listed, so all builds before 6.19.5 should be considered at risk until patched.

The CVSS score of 7.5 indicates a high impact vulnerability. The EPSS score is not available, and the issue is not currently listed in CISA KEV. Based on the description, the attack vector is local file inclusion, which typically requires the attacker to supply a malicious path to the plugin. The exploitation does not require additional authentication beyond the usual plugin access, making it feasible in situations where the plugin is exposed to the public web interface. Due to the absence of a known exploit in the wild, the immediate threat remains theoretical, but the high severity warrants prompt remediation.