This issue stems from an improper control of filenames used in PHP include/require statements, exposing a Local File Inclusion flaw. The vulnerability allows an attacker to supply arbitrary filenames, which the plugin then includes without validation. Although the description does not explicitly confirm RCE, including PHP files from the local filesystem can result in remote code execution or at least disclosure of sensitive information such as configuration files or passwords. The weakness is classified as CWE‑98.

The vulnerability affects the Stylemix MasterStudy LMS WordPress plugin, specifically all releases from the initial version up through 3.5.28. No lower bound is stated, so any installation of these versions is susceptible.

The CVSS score of 8.8 indicates a high severity potential for exploitation. The EPSS score of 2% indicates a low but measurable likelihood that the vulnerability is currently being exploited in the wild, and it is not present in the CISA KEV catalog. The likely attack vector is remote, inferred from the nature of a WordPress plugin and the ability to manipulate request parameters to influence the include path. An attacker who can supply a crafted filename parameter in a request could trigger the inclusion of arbitrary local files, potentially leading to information disclosure or code execution if the included file is executable PHP code.