This vulnerability arises from improper validation of filenames used in PHP include or require statements within the WooCommerce Coming Soon Product with Countdown plugin by WebCodingPlace. It allows PHP Local File Inclusion, which can be exploited by an attacker with low privileges to include arbitrary local files on the server. The affected versions are up to 5.0. The CVSS v3.1 base score is 6.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker with low privileges can exploit this vulnerability to include local files on the server, potentially leading to information disclosure, modification of data, or disruption of service. The impact is rated medium severity with partial loss of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the plugin and limiting privileges may reduce risk.