The vulnerability stems from improper control of the filename used in include/require statements within the Pack Elementor addons plugin, categorised as CWE‑98. An attacker can induce the plugin to include arbitrary local files, potentially exposing sensitive configuration files or enabling remote code execution if paired with other weaknesses. The flaw directly compromises the confidentiality and integrity of the WordPress installation where the plugin is deployed.

WordPress sites running the Pack Elementor addons plugin provided by webangon, from the earliest release through version 2.1.1, are affected.

The CVSS score of 7.5 signals a high severity, while the EPSS score of less than 1% indicates that exploitation is currently expected to be rare and the issue is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector is a crafted HTTP request that manipulates the plugin’s filename input, giving an attacker file read or code execution capabilities under certain circumstances. Administrators should view this as a significant risk with a low but non‑zero likelihood of exploitation.