This vulnerability stems from improper control of filenames used in PHP include/require statements within the InstaWP Connect plugin. The flaw permits an attacker to manipulate the filename parameter, enabling the execution of local file inclusion attacks. As a result, a malicious user could read sensitive files, such as configuration files or other confidential data, which may lead to privilege escalation or compromise of the entire WordPress site. The weakness is identified by CWE‑98.

WordPress sites utilizing the InstaWP Connect plugin, versions up through 0.1.0.82. No other vendors or products are known to be affected.

The CVSS score of 7.5 indicates moderate to high severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. While the description does not specify the exact attack vector, it is inferred that a remote attacker could trigger the inclusion by sending a crafted HTTP request to the plugin’s input handling endpoint. The lack of remote file inclusion support implies the attack relies on local file paths supplied via user input.