The DeBounce Email Validator plugin for WordPress contains a flaw due to improper control of the filename supplied to PHP's include/require statements, a classic Local File Inclusion vulnerability. The plugin accepts a filename parameter without sufficient sanitization, allowing an attacker to supply a user‑controlled path that causes the application to read or execute files from the local filesystem. This weakness is identified by CWE-98. If exploited, sensitive configuration files or application logic may be disclosed, and where file permissions permit, the attacker could modify or overwrite files, potentially leading to broader compromise.

WordPress sites that use the DeBounce Email Validator plugin version 5.7 or older. The affected product is the debounce:DeBounce Email Validator plugin. No specific WordPress core or PHP version is mentioned, but the vulnerability applies to all installations running a vulnerable version of the plugin regardless of other software on the server.

The CVSS score of 7.5 indicates a high severity. The EPSS score is <1%, suggesting that the likelihood of exploitation is currently low, but the vulnerability is still potentially valuable to attackers. The flaw is not listed in the CISA KEV catalog, so it has not been reported as a known exploited vulnerability yet. Nevertheless, the attack path is straightforward: an attacker who can influence the filename parameter used by the plugin – for example, via crafted URLs or malicious form submissions – can trigger the inclusion of arbitrary files. Based on the description, it is inferred that no authentication or elevated privileges are required, which heightens the risk for unprotected WordPress sites.