An improper handling of filenames in the CSS & JavaScript Toolbox plugin’s include/require statements allows an attacker to include local files on the web server. The vulnerability could enable the attacker to read sensitive configuration files, user data, or potentially execute arbitrary code if a local file containing PHP code is included. The weakness is classified as a Local File Inclusion, which directly compromises confidentiality and integrity of the affected system.

The flaw is present in all versions of the CSS & JavaScript Toolbox plugin released by wipeoutmedia prior to 12.0.3. Any site running the plugin with a version less than 12.0.3 is potentially affected. There is no evidence that later versions are impacted.

The CVSS score of 7.5 indicates high severity. The EPSS score of <1% suggests that exploitation is currently uncommon, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is Local File Inclusion, whereby an attacker who can supply a crafted request path may trigger the inclusion of arbitrary local files.