Adrian Tobey’s MailHawk plugin for WordPress contains a Validate File Input weakness that allows an attacker to control the filename used in a PHP include or require statement. The flaw is classified as CWE‑98 and can lead to local file inclusion, which may expose sensitive files or enable the execution of arbitrary PHP code if a malicious file is included. Consequently, an attacker could read configuration data or gain remote code execution on the affected system.

WordPress sites that have the MailHawk plugin installed, from its initial release through version 1.3.1. All versions of the plugin up to and including 1.3.1 are susceptible; any site running these versions should be considered vulnerable.

The CVSS base score is 7.5, indicating significant impact. The EPSS score is < 1 %, suggesting exploit attempts are rare, and the vulnerability is not listed in the CISA KEV catalog. Still, the lack of hardening around the include mechanism means that an attacker who can influence the plugin’s filename logic—likely via a crafted HTTP request—could read arbitrary files or execute code if a local file containing PHP is included.