The plugin contains an Improper Control of Filename for Include/Require Statement in PHP (CWE-98) that allows local file inclusion. By supplying a crafted filename, an attacker can cause the application to include arbitrary files from the filesystem, potentially reading sensitive data and, if PHP code or configuration files are included, executing arbitrary code. This vulnerability directly threatens the confidentiality, integrity, and availability of the WordPress site.

The vulnerability affects the External Store for Shopify plugin developed by Fahad Mahmood, specifically all installations of versions 1.5.9 or earlier. WordPress sites that have this plugin active and have not applied the latest updates are at risk.

The CVSS score of 7.5 classifies this flaw as high, while the EPSS score of < 1% indicates a very low current exploitation probability. It is not listed in the CISA KEV catalog. The most likely attack vector is via remote interaction with the plugin’s user‑controlled parameters, allowing an attacker to influence the include path. If the vulnerability is successfully exploited, the attacker could read local files or execute code on the server.