The unfoldwp Magazine Saga plugin for WordPress versions up to 1.2.7 contains an improper control of filename vulnerability in PHP include/require statements. This results in a Local File Inclusion vulnerability, where an attacker can manipulate the filename parameter to include unintended local files on the server. The vulnerability is identified as CVE-2025-53227 with a CVSS 3.1 base score of 8.1, reflecting high impact across confidentiality, integrity, and availability. No patch or official remediation information is currently available, and the plugin is not a cloud service, so remediation depends on vendor patch release.

Successful exploitation of this vulnerability can lead to disclosure of sensitive local files, potentially exposing credentials or configuration data. It may also allow an attacker to execute arbitrary code or disrupt service availability depending on the included files. The high CVSS score reflects significant risk to confidentiality, integrity, and availability of affected systems running the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is released, users should consider disabling or removing the vulnerable plugin to mitigate risk. Avoid exposing the affected application to untrusted users or networks. Monitor vendor channels for official fixes and apply updates promptly once available.