The Background animation blocks plugin contains a flaw that allows an attacker to supply an arbitrary filename to an include/require statement in PHP. This improper handling of filenames (CWE‑98) permits local file inclusion, enabling the reader of any file accessible to the web server. If the included file is a PHP script, the attacker may be able to execute code, otherwise file contents can be exposed. The CVSS score of 8.1 reflects the potential impact on confidentiality, integrity, and availability.

Webarea’s Background animation blocks plugin is affected in all releases from the initial release up through version 2.1.5. Any installation using v2.1.5 or lower is vulnerable.

The vulnerability can be exploited when the attacker can influence the filename parameter supplied to the plugin, which may be possible through the plugin’s configuration interface or by manipulating the URL. The EPSS score of 1 % indicates a low but non‑zero probability of exploitation, yet the high CVSS rating signals a rapid escalation risk if exploited. The flaw is not listed in the CISA KEV catalogue, but given its severity and potential for data exposure or code execution, it should be treated with urgency.