The vulnerability arises from improper validation of the filename used in PHP's include/require statement. The plugin allows a local file path to be passed without sanitization, enabling a locally stored file to be read or executed. This can lead to disclosure of sensitive data or arbitrary PHP code execution, potentially compromising the entire WordPress installation.

Affected are all installations of the Exthemes WP Food ordering and Restaurant Menu plugin for WordPress from the initial release through version 2.7. Any site that has not upgraded beyond 2.7 is potentially vulnerable.

The CVSS score of 8.1 indicates high severity. The EPSS score of <1% suggests a low current exploitation likelihood, and the vulnerability is not included in CISA’s KEV catalog. The likely attack vector requires an attacker to supply a malicious filename parameter; based on the description it is inferred that the vulnerable parameter may be exposed via public or administrative interfaces. Successful exploitation could result in reading arbitrary files or executing PHP code, posing significant confidentiality, integrity, and availability risks.