This vulnerability in the Essential Plugin Hero Banner Ultimate (<= 1.4.4) arises from improper control of filenames used in PHP include or require statements, resulting in a Local File Inclusion (LFI) flaw. The CVSS score is 6.5 (medium severity) with an attack vector over the network, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality but not integrity or availability. The vulnerability could allow an attacker to read local files on the server by manipulating the filename parameter. There is no vendor advisory or patch information provided at this time.

An attacker with low privileges can exploit this vulnerability remotely to include local files on the server, potentially exposing sensitive information. The impact is limited to confidentiality as integrity and availability are not affected. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the affected plugin and consider disabling it if possible. Monitor vendor channels for updates and apply any official patches promptly once released.