The vulnerability is an unauthenticated local file inclusion flaw that exists in the DirectoryPress plugin for WordPress versions up to 3.6.27. It allows an attacker to read arbitrary files on the server that are accessible through the affected plugin's endpoints. Because the plugin processes user-supplied input without proper validation, an attacker could also leverage the included file to execute malicious code, potentially taking full control of the host. The weakness is categorized as CWE-98.

Designinvento's DirectoryPress plugin for WordPress, specifically all releases through and including version 3.6.27, are affected. Users running any of these versions on a publicly accessible WordPress site are at risk.

The CVSS score of 9.8 marks this as a critical vulnerability. The EPSS score is not available, so the exact likelihood of exploitation in the wild is unknown, but because the flaw is unauthenticated and operates via a web request, the window for exploitation is wide. The vulnerability is not currently listed in the CISA KEV catalog, suggesting there are no confirmed exploits in the field yet, however the high base score and lack of mitigations mean malicious actors could target vulnerable installations opportunistically.