The Edge-Themes Edge CPT plugin for WordPress versions up to 1.4 contains a vulnerability due to improper control of filenames in PHP include/require statements. This allows an attacker to perform Local File Inclusion (LFI), potentially executing arbitrary local files on the server. The vulnerability is remotely exploitable over the network without authentication or user interaction, but requires high attack complexity. The CVSS 3.1 base score is 8.1, reflecting high confidentiality, integrity, and availability impacts. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability can lead to arbitrary local file inclusion, allowing attackers to execute code or access sensitive files on the affected server. This compromises the confidentiality, integrity, and availability of the system running the Edge CPT plugin. Given the high CVSS score, the impact is significant if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Edge CPT plugin if possible to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.