The vulnerability is an improper control of the filename for the include/require statement in the IDonate plugin, allowing an attacker to trigger PHP Local File Inclusion. Through this flaw an adversary could request a crafted path that causes the plugin to include an arbitrary local file, potentially leading to execution of attacker‑supplied code, data disclosure, or availability disruption. The weakness is identified as CWE‑98, which denotes inclusion of local files without sufficient validation.

WordPress IDonate plugin, developed by Foysal Imran, is affected in all releases from the initial version up to and including 2.1.18. Users running any of these versions are vulnerable.

The CVSS score of 8.1 classifies this issue as high severity. The EPSS score of less than 1% indicates that, according to current exploitation data, the probability of being targeted is low, and the vulnerability is not listed in the CISA KEV catalog. However, if an attacker gains access to a vulnerable WordPress instance, the Local File Inclusion can be leveraged to execute arbitrary code on the server or read sensitive files. The likely attack vector is a crafted HTTP request targeting a parameter that is passed to the include/require statement within the plugin. The vulnerability therefore poses a potential confidentiality, integrity, and availability risk to affected systems.