The vulnerability is an improper control of the filename used in a PHP include/require statement, allowing an attacker to request arbitrary local files through the Chop Chop Pop‑Up Chop Chop plugin. If the attacker supplies a path that points to a file containing executable PHP code, the server may include that code, resulting in the execution of arbitrary scripts and a full compromise of the website's confidentiality, integrity, and availability.

Chop Chop Pop‑Up Chop Chop plugin, any version up to and including 2.1.7, which is actively released to WordPress sites.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not yet listed in the CISA KEV catalog, but its impact could be severe if exploited. The likely attack vector is through a web‑based request that triggers the vulnerable include, requiring only local file inclusion payloads from the attacker's side.