The vulnerability arises from improper validation of filenames used in PHP include/require statements by the Material Dashboard plugin. Based on the description, it is inferred that an attacker can supply arbitrary local file paths through user-controllable inputs. This flaw can be used to read sensitive files such as configuration files or credential storage, and if the attacker can place a PHP file in the allowed path, they may achieve remote code execution. The plugin does not enforce strict path checks or sandboxing, so the risk escalates if arbitrary files can be read or executed.

The issue impacts the Hossein:Material Dashboard WordPress plugin for all releases up to version 1.4.5 inclusive. No other vendors appear to be affected. The namespace of affected software is identified by the CNA and includes all versions from the earliest available through 1.4.5.

The CVSS score of 7.5 indicates high severity. The EPSS score is less than 1%, indicating low observed exploitation. The plugin is not listed in CISA’s KEV catalog. The likely attack vector is remote through HTTP requests, as the plugin is executed in a web‑accessible context and accepts parameters that influence the include path. An unauthenticated attacker can trigger the flaw by manipulating query strings or file paths processed by the plugin, potentially reading files or executing PHP code. The overall risk remains significant for publicly exposed sites that run the vulnerable plugin.