This vulnerability stems from improper control of filenames for an include/require statement in the Stylemix Motors plugin. The flaw enables a local file inclusion (LFI) that can expose sensitive files or allow execution of arbitrary PHP code when combined with other weaknesses. The vulnerability is classified as CWE‑98, reflecting the risk of using uncontrolled input to determine include paths. If exploited, an attacker could read configuration files, passwords or other critical data, and, in a worst‑case scenario, run malicious code on the server.

The affected component is the Stylemix Motors "Motors" WordPress plugin, version 1.4.71 and earlier. No further version details are supplied by the CNA; administrators should verify that no installation of this plugin is present.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% implies that, according to current data, the probability of exploitation is low, but the lack of a public exploit does not eliminate risk entirely. The vulnerability is not listed in the CISA KEV catalog. Given that LFI typically requires some form of local access or a separate injection vector (e.g., file upload), the attack vector is likely local or requires authenticated access via the WordPress admin interface. An attacker who can trigger the vulnerable include could gain unauthorized read or code execution privileges depending on server file permissions.