The WP Newsletter Subscription plugin (versions up to 1.1) suffers from a path traversal vulnerability (CVE-2024-44012) that allows an attacker to include local files via crafted pathname input. This improper restriction of pathnames can lead to PHP Local File Inclusion, potentially resulting in confidentiality, integrity, and availability impacts. The vulnerability is remotely exploitable without privileges but requires user interaction. The CVSS 3.1 vector indicates network attack vector, high complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to include arbitrary local files on the server, potentially leading to disclosure of sensitive information, modification of data, or disruption of service. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin to mitigate risk. Monitor vendor channels for updates or patches addressing this vulnerability.