The vulnerability is an Improper Control of Filename for Include/Require Statement in PHP, a Local File Inclusion flaw that allows an attacker to cause the plugin to include arbitrary files from the server. This can expose configuration files, passwords, or other secrets and may serve as a foothold for further exploitation if the included content is executed as code.

The affected product is the hockeydata LOS WordPress plugin, version 1.2.4 and earlier. All releases in that range are vulnerable.

The CVSS base score of 7.5 indicates moderate‑to‑high severity, but the EPSS score of less than 1% suggests that exploitation is unlikely in the current environment. Based on the description, it is inferred that the likely attack vector is a crafted HTTP request that triggers the inclusion of a local file, and that the vulnerability does not require authentication, as the plugin includes files without checking user context. The plugin is not listed in the CISA KEV catalog, indicating no widespread exploitation has been reported.