The WPBean WPB Category Slider for WooCommerce plugin (version ≤ 1.71) suffers from an improper control of filename in PHP include/require statements, resulting in a Local File Inclusion vulnerability. This vulnerability allows an attacker with low privileges to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring high attack complexity and low privileges without user interaction. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could lead to local file inclusion, enabling attackers to read sensitive files, execute arbitrary code, or disrupt service. The vulnerability affects confidentiality, integrity, and availability of the affected system. However, exploitation requires low privileges and high attack complexity, with no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and monitor for suspicious activity related to file inclusion attempts. Avoid using affected versions of the plugin in production environments if possible.