This CVE scores 6.5 on CVSS, which badly undersells the risk. The vulnerability is an unauthenticated local file inclusion through an open AJAX endpoint with trivial path traversal — no credentials required, no user interaction needed, and the path is attacker-controlled via '../' sequences. That's a minimum-exploit-threshold failure that the CVSS model doesn't weight appropriately for WordPress environments.
The critical detail the CVSS score ignores: this isn't theoretical 'local file inclusion' where you read /etc/passwd. In a default WordPress installation, several PHP files execute code when called directly rather than included — wp-cron.php triggers scheduled tasks (including plugin and theme code), xmlrpc.php provides admin function side channels, and various template files invoke do_action hooks. The exploitation chain requires zero knowledge of the plugin's internals. An attacker just needs to know the path to a WordPress core file with exploitable side effects, which is public knowledge.
The AJAX endpoint lacks a capability check — a common failure in WordPress plugins, because WordPress core makes all AJAX hooks publicly accessible by default. The framework places authentication entirely on the developer. There's no default-deny security model prompting developers to add current_user_can() checks.
What to check: confirm your deployment is on plugin version 6.1.3 or later. If you're on an earlier version, treat this as critical — the exploit requires only a crafted request to the AJAX endpoint with a path traversal payload pointing at a WordPress core file with ABSPATH guards that are weak or absent. The temporal blast radius is substantial: automated scanners will pick this up within hours of disclosure, and many sites run outdated commercial plugins. Prioritize this patch ahead of medium-severity CVSS items that don't combine unauthenticated access with trivial path traversal in a widely-deployed plugin.