The vulnerability arises from improper control of the filename used in PHP include/require statements in the Fami Sales Popup plugin. An attacker can manipulate input to cause the plugin to include an arbitrary local file, which may result in disclosure of sensitive data or execution of arbitrary PHP code. The weakness corresponds to CWE‑98 and is rated as a high‑severity issue due to the potential for remote code execution if the web server runs the included file.

Affected systems are installations of the WordPress plugin Fami Sales Popup produced by zankover. Any instance using version 2.0.0 or earlier is vulnerable. The vulnerability affects all releases from the initial version up to and including 2.0.0.

The CVSS base score of 7.5 indicates a high risk, and the EPSS score of 1% shows a low but non‑negligible probability of exploitation in the field. The vulnerability is not currently listed in the CISA KEV catalog. Attackers are likely to exploit the issue by accessing the plugin’s vulnerable parameters through the web interface, potentially triggering the include with a crafted path. No additional prerequisites are documented, but the plugin must be reachable over HTTP/HTTPS for the attack to succeed.