The flaw is an improper control of filenames in include/require statements within the Majestic Support WordPress plugin, allowing an attacker to supply a controlled path. This Local File Inclusion can expose confidential site files and, if the attacker can manipulate the include to execute code, lead to remote code execution. The weakness is classified as CWE-98. The impact is limited to the application scope but can be escalated to full system compromise if file execution is possible.

The issue affects the Majestic Support plugin for WordPress versions up through 1.0.6, including the package name Majestic Support: Majestic Support. No specific Windows or OS distribution is tied to the vulnerability; it operates within any WordPress installation that hosts affected plugin versions.

The CVSS score of 8.1 indicates a high severity. The EPSS score of less than 1% suggests a low probability of immediate exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s interface or crafted URLs that exploit the vulnerable include, requiring no elevated privileges on the web server beyond those granted to the web application.