The vulnerability is an improper limitation of a pathname to a restricted directory, allowing a Path Traversal condition that can be exploited for PHP Local File Inclusion. In a successful exploitation, an attacker may read arbitrary files on the server or execute arbitrary code, thereby compromising confidentiality, integrity, or availability of the affected WordPress site.

WordPress sites that use the moaluko Store Locator plugin version 3.98.10 or earlier are affected. Any installation of this plugin within that version range is vulnerable.

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% shows a very low likelihood of exploitation at the time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is likely local file inclusion via the plugin’s path handling. An attacker with sufficient privileges to interact with the plugin (e.g., an authenticated administrator or a malicious user with file upload capabilities) could craft a specially crafted request that leads the plugin to include an arbitrary file from the server’s filesystem.