The vulnerability comes from improper control of the filename used in a PHP include/require statement inside the Rashid Docpro WordPress plugin. An attacker can supply an arbitrary local file path, causing the server to read or execute unintended files. This can lead to disclosure of sensitive configuration, user data, or execution of arbitrary PHP code, potentially compromising the entire WordPress site.

All releases of the Rashid Docpro plugin from the initial version through version 2.0.1 are affected. No higher version is impacted, so upgrading past 2.0.1 removes the flaw.

The CVSS score of 9.8 marks the flaw as critical, while the EPSS score of less than 1% indicates a low current exploitation probability and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely local or via a web request that can influence the plugin’s input, allowing an attacker to read arbitrary files or trigger PHP execution, which could result in full site compromise.