This vulnerability arises from improper validation or control of filenames used in PHP include or require statements within the WooCommerce Coming Soon Product with Countdown plugin by WebCodingPlace. The flaw allows local file inclusion, which can lead to disclosure of sensitive files, code execution, or denial of service. The CVSS score is 7.5 (high), reflecting network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The affected versions include all up to 5.0. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, execution of arbitrary code, or disruption of service. The vulnerability impacts confidentiality, integrity, and availability at a high level. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.