Unauthenticated Local File Inclusion in the MDTF WordPress plugin allows an attacker to specify arbitrary file paths that the plugin reads and returns to the requester. The flaw corresponds to CWE‑98. Through this vulnerability, an attacker can read sensitive files on the server, resulting in confidentiality loss and potentially delivering code if writable files are included, which could lead to further compromise.

WordPress sites that have the MDTF plugin from PluginUs.Net installed on version 1.3.8 or earlier are affected. Sites running the plugin on any higher version are not considered vulnerable.

The CVSS score of 8.1 indicates a high severity risk. The EPSS score is not available, which limits insight into current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is unauthenticated and only requires a crafted request to the plugin’s endpoint, any visitor can potentially trigger it, making the risk significant for exposed sites.