The vulnerability is an improper control of the filename used in a PHP include/require statement, allowing an attacker to request arbitrary local files through the Chop Chop Pop‑Up Chop Chop plugin. If the attacker supplies a path that points to a file containing executable PHP code, the server may include that code, potentially allowing the execution of arbitrary PHP scripts on the server, which may affect the site’s confidentiality, integrity, and availability.

Chop Chop Pop‑Up Chop Chop plugin, any version up to and including 2.1.7, which is actively released to WordPress sites.

The CVSS score of 7.5 indicates high severity, while the EPSS score of 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but its impact could be severe if exploited. The likely attack vector is through a web‑based request that triggers the vulnerable include, requiring only local file inclusion payloads from the attacker’s side.