CVE-2022-45374

The YARPP plugin contains a local file inclusion vulnerability in versions through 5.30.4 where the yarpp shortcode fails to properly validate the template parameter, enabling users with subscriber access or higher to include and execute arbitrary files from the server. An attacker could leverage this flaw to run arbitrary PHP code, potentially bypassing security restrictions, accessing sensitive information, or executing malicious code through uploaded files that would normally be considered harmless. The vulnerability was resolved in version 5.30.5.

Based on public CVE data (MITRE/NVD).