The Creta Testimonial Showcase WordPress plugin versions before 1.2.4 contain a Local File Inclusion vulnerability. Authenticated users with editor-level or higher privileges can exploit this flaw to include and execute arbitrary files on the server, potentially running any PHP code contained within those files. This vulnerability has a high severity rating with a CVSS score of 7.2.