The Dylan Kuhn Geo Mashup plugin for WordPress versions up to 1.13.16 contains a vulnerability classified as improper control of filename for include/require statements in PHP, resulting in a Local File Inclusion (LFI) issue. This vulnerability allows unauthenticated remote attackers to include local files on the server by manipulating the filename parameter used in PHP include or require functions. The vulnerability is critical with a CVSS 3.1 base score of 9.8, reflecting its network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided in the data, and no exploits are known in the wild.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files, execute arbitrary code, or cause denial of service. The impact affects confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the vulnerability poses a severe risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable Geo Mashup plugin to mitigate risk. Monitor official Dylan Kuhn or Geo Mashup project channels for updates and patches addressing this vulnerability.