The ThemeGoods Photography plugin for WordPress contains an improper control of filename vulnerability in its PHP include/require statements, classified as a PHP Local File Inclusion issue. This vulnerability affects versions before 7.7.5 and allows an attacker to potentially include local files on the server, which can lead to arbitrary code execution or information disclosure. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch link provided, and the product is not a cloud service, so remediation status is currently unknown.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include and execute local files on the server hosting the vulnerable plugin. This can lead to full compromise of the affected system, including disclosure of sensitive information, modification of data, or denial of service. The high CVSS score (8.1) reflects the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided in the available data, users should monitor ThemeGoods' official channels for updates. Until a fix is available, consider disabling or removing the vulnerable plugin to mitigate risk.