This vulnerability arises from improper validation or control of filenames used in PHP include or require statements within the Melapress Login Security plugin. Specifically, it allows remote file inclusion, which can lead to unauthorized disclosure of information. The issue affects all versions up to 1.3.0. The CVSS score is 4.9 (medium severity), with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and impacting confidentiality only. No patch or vendor advisory is currently available.

An attacker with high privileges on the system could exploit this vulnerability to include remote files via the vulnerable PHP include/require statements. This could lead to unauthorized disclosure of sensitive information. There is no impact on integrity or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected plugin to trusted users only, and monitor for any unusual activity. Avoid exposing the plugin to untrusted users with high privileges. Follow vendor updates closely for an official fix.