This vulnerability arises from improper sanitization of filenames used in PHP include/require statements within the Deetronix Affiliate Coupons plugin. The flaw allows an attacker to specify arbitrary local files for inclusion, potentially exposing sensitive data or executing malicious code on the affected site. The primary threat is that an attacker could read or execute files on the web server, leading to source code disclosure, credential theft, or remote code execution if suitable files are included. The weakness is classified as CWE-98, underscoring the importance of secure handling of file paths.

The issue affects the Deetronix Affiliate Coupons WordPress plugin versions up to and including 1.7.3. Users running any of these versions on a WordPress installation are at risk unless the plugin is upgraded or removed.

With a CVSS score of 7.5, the problem is moderately high severity. The EPSS score is below 1 %, indicating a low probability of exploitation, and the vulnerability is not currently listed in CISA’s KEV catalog. Nonetheless, the attack vector is likely via crafted HTTP requests that manipulate the filename parameter; if an attacker can supply input to the vulnerable code, they can trigger the inclusion of arbitrary local files. The potential impact extends to confidentiality and integrity of site data and system resources.