The vulnerability stems from improper control of the filename used in an include/require statement, allowing a local file to be included by the plugin. This flaw can enable an attacker to read arbitrary files on the server or, if the included file contains PHP code, to execute it, leading to significant compromise of confidentiality, integrity, or availability. The weakness is identified as CWE-98.

The affected product is the FULL Customer "full-customer" plugin for WordPress, versions up to and including 3.1.26, from version n/a through 3.1.26, distributed by FULL SERVICES:FULL Customer.

The CVSS score is 7.5, indicating a high severity. The EPSS score is below 1 %, suggesting that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Though the attack vector is local file inclusion, an attacker who can influence the include path could inject arbitrary local files, potentially achieving remote code execution if the server permits execution of included files. The exploit path requires the attacker to have a way to influence the file path—such as through input parameters—so it is not a purely automatic remote exploit but could be leveraged once the web application is compromised or if the attacker gains access to the site’s content management interface.