The Post Grid Master plugin for WordPress suffers from a CWE-22 path traversal vulnerability via its 'locate_template' function, which improperly limits pathname access. This flaw enables unauthenticated attackers to include arbitrary local PHP files, leading to local file inclusion and potential remote code execution. The vulnerability affects all versions up to and including 3.4.12. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to include and execute arbitrary PHP files on the server hosting the vulnerable plugin. This can result in full compromise of the web server, including bypassing access controls, data disclosure, and remote code execution. The high CVSS score reflects the critical nature of this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin, disable or remove it if possible, and monitor for suspicious activity related to file inclusion attempts. Avoid uploading PHP files or other executable content to the server to reduce risk.