When the Doctor Appointment Booking plugin receives a filename it includes it directly in a PHP include statement without adequate validation, which matches CWE-98. As a result an attacker can supply arbitrary paths in an HTTP request and access files on the server that should not be publicly readable, such as configuration files, logs, or application source code. If the server permits execution of PHP files that contain the attacker’s code or if a previously compromised file is overwritten, further compromise may be possible, but the CVE entry does not explicitly state that remote code execution is guaranteed.

The vulnerability affects installations of Creativeitem’s Doctor Appointment Booking plugin on WordPress sites that are running version 1.0.0 or earlier. All WordPress sites that have not updated from the initial release are therefore susceptible.

With a CVSS score of 7.5 the vulnerability is rated high severity, but an EPSS score of 1% indicates a low likelihood of active exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed public exploits at the time of this assessment. The attack vector most likely involves a crafted HTTP request to the plugin that references a file path designed to traverse directories and include a local file.