The vulnerability CVE-2024-44034 in Martin Greenwood WPSPX (<= 1.0.2) is caused by improper limitation of a pathname to a restricted directory, enabling a path traversal attack. This flaw allows an attacker to perform PHP Local File Inclusion, potentially leading to unauthorized access to sensitive files and execution of arbitrary code. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to include local files via PHP, potentially leading to disclosure of sensitive information, code execution, and disruption of service. The high CVSS score indicates significant risk to affected systems. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable plugin, disabling it if not needed, or applying any recommended temporary mitigations from the vendor. Monitor for updates from Martin Greenwood regarding patches or official fixes.