The RadiusBlocks plugin for WordPress contains an improper control of filename for include/require statements, identified as CWE-98. This flaw enables an attacker to supply a path to include arbitrary local files in the server’s filesystem. If a malicious file contains executable code, the attacker may obtain remote code execution or disclose sensitive data. The description states the vulnerability is a PHP Local File Inclusion.

The affected product is the RadiusBlocks plugin from RadiusTheme. All versions through 2.2.1 are vulnerable; the analysis does not list a fixed version, so any installed release up to and including 2.2.1 is impacted.

The CVSS score of 7.5 indicates a high severity. The EPSS score is reported as less than 1%, suggesting current exploitation probability is very low. The vulnerability is not in the CISA KEV catalog. Attack appears to require a crafted HTTP request to the plugin’s include endpoint, making it a local file inclusion vector that could be triggered from a remote user if the path is not properly validated. Given the low EPSS, exploitation is unlikely but remains possible without an updated plugin.