This vulnerability in the wpmart Team Member plugin arises from improper validation or control of filenames used in PHP include or require statements, enabling remote file inclusion. The affected versions are up to 7.4. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, requiring low privileges, no user interaction, and limited confidentiality impact. No official patch or vendor advisory is currently available, and no exploits are known in the wild.

An attacker with low privileges can exploit this vulnerability remotely to include and execute remote files via the vulnerable PHP include/require statements. This may lead to limited confidentiality impact, such as information disclosure. There is no impact on integrity or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and consider disabling it if not essential. Monitor for vendor updates and apply patches promptly once available.