The vulnerability arises from improper control of filenames used in PHP's include/require calls, allowing locally stored files to be read or executed. An attacker who can influence the include path could read sensitive configuration files or trigger the execution of arbitrary PHP code, resulting in possible disclosure of confidential data or gain of full system compromise.

Affected are installations of the Exthemes WP Food ordering and Restaurant Menu plugin for WordPress, specifically all released versions from the initial release through 2.7. Any WordPress site deploying the plugin within this range is vulnerable until an updated release is applied.

The CVSS score of 8.1 indicates a high severity. The EPSS of less than 1% suggests very low probability of current exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Likely the attack requires the ability to supply the filename, which may be achieved through public or administrative interfaces. If successfully exploited, the attacker may read arbitrary files or execute PHP code, posing a significant confidentiality, integrity, and availability risk.