The vulnerability lies in the Popliup plugin for WordPress, where an improper control of filenames used in PHP include/require statements allows an attacker to trigger local file inclusion. This flaw, identified as a PHP Remote File Inclusion flaw, enables execution of code from arbitrary local files, potentially allowing the attacker to read sensitive data or execute arbitrary code on the server. The weakness is categorized as CWE-98 – Improper Control of Filename for Include/Require Statement.

WordPress installations using the Popliup plugin version 1.1.1 or earlier are affected. The plugin, developed by Webliup, is distributed as the Popliup product, and any site running these vulnerable versions is at risk.

The CVSS v3 score of 7.5 indicates a high impact vulnerability. However, the EPSS score of less than 1% shows a low prevalence of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector involves triggering the vulnerable include mechanism within the plugin, which may require authenticated access or exposure through the plugin’s frontend. Successful exploitation could lead to code execution and full compromise of the affected WordPress site.