The vulnerability is an improper control of the filename for the include/require statement in the JoomSky WP Vehicle Manager plugin. It allows an attacker to cause the plugin to include and potentially execute arbitrary local files on the server with the privileges of the web process. The flaw is a classic local file inclusion (LFI) weakness, identified as CWE‑98, which can lead to disclosure of sensitive data, code execution, or further compromise of the host system.

Affected systems are installations of the JoomSky WP Vehicle Manager plugin on WordPress platforms, specifically versions from the earliest release through and including version 3.1. The vendor listed is JoomSky, product WP Vehicle Manager.

The CVSS score of 8.1 rates this flaw as high severity, and the EPSS score of approximately 1.56% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a web request that triggers the plugin’s include/require logic, such as an crafted query parameter or shortcode. An attacker with network access to the web server could exploit the flaw to read or execute local files, potentially leading to full system compromise.