The Funnel Builder by FunnelKit plugin suffers from improper handling of filenames used in PHP include/require statements. The flaw allows an attacker to specify arbitrary file paths, enabling Local File Inclusion (LFI) that can expose sensitive files on the server. The vulnerability does not claim remote code execution; it narrows the impact to reading files that an authenticated or unauthenticated user may access through the plugin's exposed endpoints.

All releases of the Aman Funnel Builder by FunnelKit plugin up to and including version 3.9.0 are affected. WordPress core version does not influence the vulnerability, and releases beyond 3.9.0 are not impacted.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via HTTP requests that control the file path used in the include/require statement; however, this inference is drawn from the description and is not explicitly detailed in the advisory.