The vulnerability is an instance of improper control of filenames for include/require statements in PHP (CWE‑98), permitting an attacker to cause the BuddyForms plugin to include arbitrary local files. User‑supplied filenames are passed to PHP’s include/require without proper validation, which can allow the reading of sensitive files or the execution of malicious PHP code if the supplied path contains a file with executable content. This leads to local file inclusion that may expose confidential data or enable remote code execution when the attacker can supply a suitable file.

Themekraft BuddyForms plugin used in WordPress installations, all versions up to and including 2.9.0, are affected. The issue applies regardless of other plugins or the WordPress core version.

CVSS score of 7.5 designates high severity, while an EPSS score of less than 1% indicates exploitation is currently rare but still possible. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a public‑facing form or request that allows the attacker to specify a filename, though the precise input mechanism is not detailed in the description. The flaw is local, requiring some level of access to the WordPress installation, such as interacting with the plugin’s features.