This vulnerability arises from insufficient validation of filenames used in PHP include or require statements within the nK Visual Portfolio, Photo Gallery & Post Grid plugin up to version 3.5.1. The improper control allows an attacker with limited privileges to perform Local File Inclusion, which can lead to arbitrary code execution or disclosure of sensitive files. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring high attack complexity and low privileges without user interaction.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could execute arbitrary code or access sensitive files by including local files through the vulnerable PHP statements. The vulnerability requires network access and low privileges but has a high attack complexity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and limit user privileges to reduce risk. Monitor for updates from the vendor and apply patches promptly once released.