The vulnerability is a Path Traversal flaw (CWE-22) in the aytechnet DyaPress ERP/CRM WordPress plugin that permits PHP Local File Inclusion. The flaw allows an attacker to supply an arbitrary file path to the plugin’s include mechanism, potentially reading sensitive files or executing server‑side PHP code. The impact is therefore confidentiality and integrity compromise, and in suitable cases code execution on the web server.

The affected product is the aytechnet DyaPress ERP/CRM plugin for WordPress, versions through 18.0.2.0. Users who have installed any release from the earliest available version up to the 18.0.2.0 release are vulnerable. The plugin is part of the WordPress ecosystem, so the attack surface exists on any WordPress installation that has this plugin enabled.

The CVSS score of 8.1 reflects a high severity exploitation outcome. The EPSS score of '< 1%' indicates a low probability of exploitation as of this analysis. The vulnerability is not catalogued in CISA KEV. While the description does not state authentication requirements, it is inferred that a request to the plugin with a crafted file parameter can be made by an external user, so the attack vector is remote and likely unauthenticated. An attacker who can successfully trigger the path traversal could read arbitrary files or execute code on the host, depending on file write permissions. The likely attack vector is a web request containing a malicious file path targeting the plugin’s include logic.