The Immocaster WordPress Plugin suffers from an improper control of filename for include/require statements in PHP, classified as a PHP Local File Inclusion vulnerability. This issue affects versions up to and including 1.3.6. An attacker could exploit this vulnerability to include local files on the server, potentially leading to remote code execution or disclosure of sensitive information. The vulnerability is remotely exploitable over the network without authentication but requires high attack complexity. The CVSS vector indicates no privileges required and no user interaction needed, with high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the affected web server, including arbitrary code execution and disclosure of sensitive data. The vulnerability affects confidentiality, integrity, and availability of the system. No known active exploits have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Immocaster plugin if it is not essential. Monitoring for updates from the vendor or trusted security sources is recommended.