This vulnerability, classified under CWE-98, arises from improper control of filenames in include or require statements within the PHP code of the Restaurant Menu by MotoPress plugin. It allows unauthenticated attackers to perform local file inclusion, which can lead to remote code execution or other severe impacts. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no privileges or user interaction required.

Successful exploitation can lead to full compromise of the affected system, including disclosure of sensitive information, modification or destruction of data, and disruption of service. Because the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor vendor communications closely and apply any released patches promptly once available.