The vulnerability arises from improper validation of filenames used in PHP include/require statements within the Restaurant Menu by MotoPress plugin. This flaw enables an attacker to manipulate the file path, causing the server to read arbitrary files located on the host. While the issue does not directly grant code execution, the ability to read sensitive configuration files, backups, or user data constitutes a clear confidentiality breach and can be a stepping stone for further attacks.

WordPress sites using the Jetmonsters Restaurant Menu by MotoPress plugin mp-restaurant-menu, versions up through 2.4.4.

With a CVSS base score of 8.8, the attack matrix classifies this as high severity. The EPSS score is below 1%, indicating a low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a crafted request to a vulnerable endpoint that improperly incorporates user-supplied paths. An attacker who succeeds could read arbitrary files on the server, compromising confidentiality and potentially enabling additional attacks if sensitive files contain credentials or executable code.