The moaluko Store Locator plugin suffers from a path traversal vulnerability that improperly restricts pathname inputs, enabling PHP Local File Inclusion. This allows attackers to potentially include local files on the server, which can lead to remote code execution or disclosure of sensitive information. The vulnerability affects all versions up to and including 3.98.10. The CVSS 3.1 base score is 7.5, with network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include arbitrary local files via path traversal, potentially leading to remote code execution, data disclosure, and full compromise of the affected system. The high CVSS score reflects the significant risk to confidentiality, integrity, and availability of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the Store Locator plugin to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.