This vulnerability in CridioStudio ListingPro plugin (<= 2.9.4) involves improper limitation of a pathname to a restricted directory, resulting in a path traversal that allows PHP Local File Inclusion. An attacker with high privileges can exploit this to include local files, potentially leading to full system compromise. The vulnerability has a CVSS 3.1 base score of 8.0, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to include and execute arbitrary local files on the affected system, resulting in complete compromise of confidentiality, integrity, and availability of the application and potentially the underlying system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable plugin to trusted users only and monitor for suspicious activity related to file inclusion attempts.