The Notifications for Forms & WordPress Actions WordPress plugin prior to version 2.6 contains an improper limitation of a pathname to a restricted directory (CWE-22). Specifically, it fails to validate user input before using it to build a server-side file inclusion path. This allows authenticated users with low privileges (subscriber-level and above) to perform local file inclusion attacks, enabling execution of arbitrary PHP code on the server. The vulnerability is classified as high severity (CVSS 7.5) due to its potential to compromise confidentiality, integrity, and availability. No patch or official remediation level has been disclosed as of the published date.

Successful exploitation allows authenticated users with subscriber-level access or higher to include and execute arbitrary local PHP files on the server. This can lead to full server compromise, including unauthorized disclosure, modification, or destruction of data and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user capabilities if possible and monitor for suspicious activity related to file inclusion. Avoid granting unnecessary access to the plugin's features to untrusted users.