The vulnerability is an improper control of filename in a PHP include/require statement, enabling a local file inclusion (LFI) attack against the Nitin Prakash WC Place Order Without Payment WordPress plugin. An attacker could read arbitrary files on the server, potentially exposing sensitive configuration, log, or authentication data and providing a foothold for further compromise. The weakness is classified as CWE-98.

This issue affects the WordPress WooCommerce plugin named WC Place Order Without Payment by Nitin Prakash, versions up to and including 2.6.7. Any WordPress site that has installed a vulnerable version of the plugin is at risk.

The CVSS score of 7.5 indicates high severity, and the EPSS score of 1% suggests a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no known active exploits are reported. The likely attack vector is local; an attacker could trigger the vulnerable include by sending a crafted request that manipulates the filename used by the plugin. Successful exploitation could expose sensitive files or act as a foothold for further attacks.