The vulnerability is a CWE‑98 flaw that allows an attacker to manipulate the filename used in a PHP include/require statement. This leads to Local File Inclusion, enabling the attacker to read arbitrary files on the server and, if a PHP file is included, execute arbitrary code. The consequence is a full compromise of data confidentiality, integrity, and availability within the WordPress site.

The vulnerability affects the Stylemix Motors "motors-car-dealership-classified-listings" plugin on WordPress, for all versions up to and including 1.4.71. No specific operating systems or hosting environments are listed, so any environment running the affected plugin is susceptible.

The CVSS score of 8.1 indicates a high severity rating, while the EPSS score of less than 1% suggests that publicly available exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. It is inferred that the attack vector involves unauthenticated or low‑privileged users visiting crafted URLs or submitting specially‑formed requests that influence the include path. If triggered, an attacker could gain arbitrary code execution on the server.