An improper control of the filename used in PHP’s include/require statements in the Essential Real Estate plugin allows an attacker who can influence the file path to load local files from the server. The attacker may obtain sensitive files or execute code if a PHP file is included, exposing the web‑server process’s privileges and potentially enabling remote code execution.

The vulnerability affects all installations of WordPress Essential Real Estate by g5theme through version 5.2.0, which are found in WordPress environments.

The CVSS score of 8.1 highlights the high severity of the issue. While the EPSS score is below 1% indicating a low current exploitation probability, the flaw remains serious due to its simplicity and lack of authentication. The attack path is straightforward: a malicious actor can craft a request that passes an unchecked file path to the plugin’s include mechanism, requiring no prior login. Because of the potential for sensitive data disclosure and code execution, the risk to impacted sites is high and warrants prompt action.