The vulnerability exists in the Advanced Database Cleaner – Premium WordPress plugin and allows authenticated users with Subscriber-level or higher access to supply a 'template' parameter that causes the server to include and execute arbitrary .php files. This results in a bypass of access controls, potential disclosure of sensitive data, and the ability to run arbitrary PHP code on the server. The weakness is classified as CWE-98 (Hardcoded Path).

SigmaPlugin:Advanced Database Cleaner – Premium plugin for WordPress, versions up to and including 4.1.0 are affected.

The CVSS score of 8.8 classifies this flaw as high severity, indicating significant potential for damage. No EPSS score is available, but the lack of KEV listing does not diminish the inherent risk, especially since the attack requires only Subscriber-level authentication, which is commonly granted in many WordPress sites. An attacker who authenticates can use the LFI flaw to execute any PHP file present on the server, potentially compromising the entire site and its data.