This vulnerability allows an attacker to provide an arbitrary file path to a PHP include/require statement within the Wow‑Company Calculator Builder plugin. Based on the description, it is inferred that the attacker could read local files from the server or, if the supplied file contains executable code, trigger its execution. The weakness is a classic improper validation of the filename used in a PHP include, leading to Local File Inclusion.

WordPress sites that have installed the Wow‑Company Calculator Builder plugin in version 1.6.2 or earlier are affected. All installations of these plugin versions are at risk; newer releases (1.6.3 and later) are presumed to contain a fix.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. The CVE is not listed in the CISA KEV catalog and no public exploits have been reported. Based on the description, it is inferred that the likely attack vector involves web requests targeting the plugin’s file inclusion functionality, requiring only a normal user-level authentication to the WordPress site to trigger the vulnerability.