The vulnerability is a CWE‑98 flaw that enables an attacker to direct the filename used in a PHP include/require statement. This permits Local File Inclusion, allowing the attacker to read arbitrary files on the web server and, if a PHP file is coerced into inclusion, execute code, jeopardizing the confidentiality and integrity of the site. The description does not state that code execution is guaranteed, only that the path can be manipulated.

The Stylemix Motors motors‑car‑dealership‑classified‑listings WordPress plugin, all releases up through and including 1.4.71, is affected. Any WordPress installation that has the vulnerable plugin installed on any operating system or hosting environment is susceptible.

With a CVSS score of 8.1 the vulnerability is classified as high severity. The EPSS score of 2 % indicates that publicly documented exploitation is currently not widespread. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely an unauthenticated or low‑privilege user forming a malicious HTTP request that influences the include path; this inference comes from the mention of local file inclusion via requests, as the CVE data does not explicitly provide the exact vector.