This vulnerability arises from improper validation of filenames used in PHP include or require statements within the 'Coming Soon, Maintenance Mode' plugin. It allows an attacker to perform Local File Inclusion (LFI), potentially exposing sensitive files or executing arbitrary code on the server. The affected versions are up to 1.1.1. The CVSS v3.1 base score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, but requiring user interaction and high attack complexity.

Successful exploitation can lead to disclosure of sensitive information, unauthorized code execution, and disruption of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected plugin or disabling it if possible to reduce exposure.