An improper filename validation flaw in FantasticPlugins SUMO Reward Points allows an attacker to control the file path used in an include/require statement. This Local File Inclusion vulnerability can expose sensitive files such as configuration data or, if a remote file upload is possible, enable arbitrary PHP code execution. The flaw is classified as CWE-98 and represents a serious compromise of confidentiality and potentially integrity.

WordPress users running the SUMO Reward Points plugin from any version up to and including 30.7.0 are affected. The vulnerability applies to all installations of the plugin that have not been updated past version 30.7.0.

The CVSS score of 8.3 indicates high severity. Although the EPSS score is below 1%, suggesting a low current exploitation probability, the presence of this flaw means a local or remote attacker could exploit it if the plugin processes untrusted input. The vulnerability is not yet listed in the CISA KEV catalog, but any instance with the affected plugin version should be treated with high urgency.