The vulnerability in the wpwax WordPress plugin arises from improper limitation of a pathname to a restricted directory (CWE-22), specifically in the handling of the 'theme' parameter within the post_type_ajax_handler() function. Authenticated users with Contributor-level privileges or higher can exploit this flaw to perform Local File Inclusion, allowing them to include and execute arbitrary PHP files on the server. This can lead to full code execution, data disclosure, and bypass of access controls. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and low privileges required.

Successful exploitation allows authenticated attackers with Contributor-level access to execute arbitrary PHP code on the server, potentially leading to full compromise of the affected WordPress site. This includes bypassing access controls, accessing sensitive data, and executing malicious code. The vulnerability affects all versions up to and including 1.6.10 of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the plugin. Consider disabling or removing the vulnerable plugin if possible to mitigate risk.