Improper validation of the filename used in a PHP include/require statement allows a local file to be included. This flaw can expose the filesystem or execute attacker‑supplied code if the included file contains malicious content. The vulnerability is identified as CWE‑98. The attack is likely remote, requiring a crafted web request to the plugin’s interface, and would compromise the confidentiality, integrity, and availability of the affected WordPress site.

The issue affects the Accounting for WooCommerce plugin developed by Bastien Ho. All releases from the initial version up to and including 1.6.8 are impacted.

The CVSS score of 7.5 indicates a high severity level, while the EPSS score of less than 1% suggests that widespread exploitation is unlikely but possible. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by manipulating the filename parameter in a remote request, revealing sensitive files or enabling execution of arbitrary code if they can supply a malicious file. The low EPSS indicates that targeted exploitation may occur, but the lack of public exploit evidence suggests the risk is moderate to high depending on exposure.