The vulnerability in the Review Schema WordPress plugin allows authenticated users with contributor-level or higher permissions to trigger a local file inclusion by manipulating post meta. Because the included files can contain PHP code, an attacker can execute arbitrary scripts on the server, potentially bypassing access controls, extracting confidential data, or performing further exploitation. This flaw is a classic instance of CWE‑98, wherein insecure handling of user-controlled paths leads to inclusion of untrusted files.

The affected product is the Review Schema – Review & Structure Data Schema Plugin for WordPress. All versions up to and including 2.2.4 are vulnerable. Users running any of these versions should update to the latest release, which omits the insecure include mechanism.

The CVSS score of 8.8 classifies this flaw as high severity. The EPSS score is below 1% indicating a low but nonzero probability that exploitation will occur in the wild. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires authentication at the contributor level or higher, an attacker must first compromise or become an authenticated account before exploiting the file inclusion. Once authenticated, the attacker can supply arbitrary file paths via post meta and cause the server to execute the targeted PHP code. Given the high impact and the fact that valid user accounts are common in most installations, the risk to affected sites is significant if the flaw remains unpatched.