This vulnerability in BuddyDev MediaPress arises from improper validation of filenames used in PHP include or require statements, enabling local file inclusion (LFI). An attacker with low privileges and no user interaction required could exploit this to execute arbitrary code or access sensitive files on the server. The vulnerability affects all versions up to and including 1.5.9.1. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to include and execute local files on the server running MediaPress, potentially leading to full system compromise including data disclosure, modification, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying strict input validation, or disabling the vulnerable functionality if possible. Monitor vendor channels for updates and apply patches promptly once released.