The WerkStatt Plugin by fuelthemes versions up to 1.6.6 contains a vulnerability where the filename used in PHP include or require statements is not properly controlled. This improper control enables PHP Local File Inclusion, potentially allowing an attacker with low privileges and no user interaction to access or execute local files on the server. The vulnerability has a high CVSS score of 7.5 with network attack vector, high impact on confidentiality, integrity, and availability, and requires high attack complexity.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the affected system, leading to disclosure of sensitive information, modification of data, or denial of service. The vulnerability affects the confidentiality, integrity, and availability of the system running the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and limit permissions to reduce the risk of exploitation. Monitor for updates from fuelthemes regarding patches or official mitigations.