Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer allows an attacker to read arbitrary files on the host by manipulating the file path parameter. The vulnerability can expose configuration files, database credentials, or other sensitive data, compromising confidentiality and potentially enabling further exploitation such as code execution if the attacker can inject or modify files. "The likely attack vector is through a crafted URL or administrative input that specifies a file path."

The vulnerability affects the Panorama Viewer – 360 Degree Image + Video Viewer plugin for WordPress, versions 1.6.1 and earlier. The plugin is distributed by bPlugins. Users running any vulnerable WordPress site with this plugin installed are at risk.

The CVSS score of 7.5 indicates a high severity. Although the EPSS score is not available, the absence of KEV listing suggests no confirmed public exploits yet, but the local file inclusion flaw is a common attack vector and poses significant risk to exposed sites. Successful exploitation requires the attacker to supply a file path via the plugin’s input; no special conditions are noted in the description, making the flaw relatively straightforward to abuse if the site is publicly accessible.