The Shariff Wrapper plugin for WordPress versions up to 4.6.13 contains a path traversal vulnerability (CWE-22) that allows unauthenticated attackers to include and execute arbitrary files on the server through the shariff3uu_fetch_sharecounts function. This local file inclusion flaw can be exploited to run arbitrary PHP code, potentially bypassing access controls and exposing sensitive information. The vulnerability is rated critical with a CVSS 3.1 score of 9.8, reflecting its high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor, and the product is not a cloud service.

Successful exploitation allows unauthenticated attackers to include arbitrary files on the server and execute PHP code, leading to full system compromise. This can result in bypassing access controls, unauthorized data disclosure, and disruption of service. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable plugin and consider disabling or removing it if possible. Monitor for updates from the vendor and apply patches promptly once available.