The vulnerability arises from improper validation of a filename used in a PHP include statement, allowing an attacker to coerce the server into including local files. This flaw can expose sensitive files such as configuration files or allow the inclusion of files that contain malicious code, potentially leading to local code execution. The weakness is classified as CWE‑98, a known filename isolation problem that undermines data confidentiality and system integrity.

The issue affects the WordPress Team Manager plugin supplied by Maidul, specifically all releases through version 2.1.23 inclusive. Users operating any older or the same versions of this plugin within a WordPress site are at risk.

The CVSS score of 7.5 attests to a high severity condition, while the EPSS score of < 1 % indicates that the likelihood of exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local file inclusion attempt triggered via an unsanitized request parameter, which may require site access that includes at least user privileges that can interact with the plugin’s input fields. If someone can supply a crafted filename, they can read arbitrary files and potentially execute code, compromising confidentiality, integrity, and availability at the application level.