The vulnerability in wpWax Logo Showcase Ultimate plugin (up to version 1.4.4) involves improper control over the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This allows an attacker with low privileges to include local files on the server, potentially exposing sensitive data. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No known exploits in the wild or patch information is currently available.

An attacker with low privileges can exploit this vulnerability remotely to include local files on the server, potentially disclosing sensitive information. There is no indication of impact on data integrity or system availability. The confidentiality impact is rated high due to possible exposure of sensitive files. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and consider disabling it if possible. Monitor for vendor updates or patches addressing this vulnerability.