The IDonatePro plugin includes a PHP include/require that does not sanitise user‑supplied filenames, allowing an attacker to specify arbitrary paths. This flaw is a Local File Inclusion vulnerability (CWE‑98) that can enable the reading of sensitive files on the server or, in some configurations, execution of arbitrary PHP code. If the attacker can supply a path to a writable file or a crafted PHP file, the application may execute it, potentially compromising the entire WordPress site.

The affected product is the WordPress plugin ThemeAtelier IDonatePro, versions up to and including 2.1.9. All installations of this plugin that have not been updated beyond 2.1.9 are vulnerable.

The high CVSS score of 8.1 indicates severe potential impact if exploited. However, the EPSS score of <1% suggests that current exploitation is rare. The likely attack vector is an HTTP request that controls the include parameter, potentially from an authenticated or unauthenticated user. Although offline exploitation is possible, the vulnerability could also lead to remote code execution if an attacker can write or point to a PHP file. No report of current exploitation or KEV inclusion further indicates low immediate threat, but the impact remains significant.