The vulnerability CVE-2024-47645 in the Top Bar – PopUps plugin by WPOptin allows improper limitation of a pathname to a restricted directory, enabling PHP Local File Inclusion. This can lead to an attacker including and executing arbitrary local files on the server. The affected versions include all releases up to 2.0.1. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, high impact on confidentiality, integrity, and availability, but requiring user interaction and high attack complexity.

Successful exploitation could allow an unauthenticated attacker to include and execute arbitrary local files on the affected server, potentially leading to full compromise of the web server, data disclosure, or denial of service. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. However, there are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor official WPOptin or Danish Ali Malik channels for updates and apply patches promptly once available.