The vulnerability arises from improper control of filenames used in PHP include/require statements within the Material Dashboard WordPress plugin. An attacker can supply a crafted file path that the plugin then interprets, allowing the website to read or execute local files on the server. This can lead to confidentiality breaches by exposing sensitive configuration data, database credentials, or potentially to code execution if the included content is executable. The weakness is classified as CWE‑98.

The affected product is the Material Dashboard plugin for WordPress, developed by Hossein. Any installation of the plugin version 1.4.5 or earlier is vulnerable. The vulnerability is present from the earliest released version through all releases up to and including 1.4.5.

With a CVSS score of 8.1 the vulnerability is considered high risk. The EPSS score of less than 1% indicates a low current probability of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote web request that supplies a malicious file path to the plugin, which the PHP code then accepts and processes without proper validation.