The WP Timeline – Vertical and Horizontal timeline plugin by Ex-Themes suffers from an improper control of filename in PHP include/require statements, enabling remote file inclusion (RFI). This vulnerability affects all versions up to 3.6.7. An attacker can exploit this flaw to execute arbitrary code remotely by controlling the file path included by the PHP program. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction. No patch or official fix has been referenced in the available data.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code on the affected server, potentially leading to full compromise of the web application and underlying system. This includes unauthorized disclosure, modification, or destruction of data and disruption of service. Given the high CVSS score and the nature of remote file inclusion, the impact is critical to the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Additionally, restricting web server permissions to limit PHP include paths and employing web application firewalls to detect and block suspicious requests may provide temporary mitigation.