The WPCHURCH plugin includes a PHP include/require statement that does not properly sanitize the filename supplied by a user. This flaw, classified as CWE-98, allows an attacker to cause the server to include arbitrary local files. If the included file contains PHP code, the attacker may run arbitrary code on the host, compromising confidentiality, integrity, and availability of the website and potentially the underlying server.

The vulnerability affects the Mojoomla WPCHURCH plugin for WordPress up to and including version 2.7.0. Any site running this plugin from its initial release through 2.7.0 is susceptible and needs to be assessed for exposure.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests that, as of the latest data, exploitation is currently uncommon, and the vulnerability has not been listed in CISA’s KEV catalog. However, the flaw is externally exploitable via a crafted HTTP request that supplies a malicious file path to the plugin. An attacker with this ability can read arbitrary files or execute code, making the risk significant for exposed WordPress sites.