The vulnerability in CRC‑Lab’s Image Gallery Box occurs because the plugin accepts user‑supplied file names and uses them directly in a PHP include/require statement. This improper control of the filename enables an attacker to read or execute arbitrary files on the server. The consequence is a loss of confidentiality and integrity for files on the host, and in the worst case can lead to remote code execution of malicious PHP. The weakness is classified as CWE‑98, which covers improper control of filename.

The flaw affects installations of the WordPress plugin Image Gallery Box by CRUDLab from the earliest release up through version 1.0.3. Any WordPress site that has a vulnerable instance of this plugin installed is at risk.

The CVSS score of 7.5 reflects a high impact combined with the fairly easy exploitation path. The EPSS score of 2% indicates that, as of this assessment, attacks against this weakness are likely but not widespread. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been abused at scale. An attacker can trigger the inclusion by sending a crafted request to the plugin endpoint, typically via a web form or crafted URL that supplies a file name value. Successful exploitation can obtain sensitive files or inject code, giving the attacker control over the affected server.