The Capturly WordPress plugin contains a flaw where the filename supplied to a PHP include/require statement is not properly validated, leading to a Local File Inclusion vulnerability. This weakness permits an attacker to read any file that the web server can access, potentially exposing sensitive configuration data or credentials. The issue is classified as CWE-98, which identifies improper control of the filename used for inclusion.

All installations of the Capturly plugin with a version of 2.0.1 or earlier are affected. Owners of WordPress sites running these plugin versions are at risk regardless of the specific WordPress configuration.

The CVSS base score is 7.5, indicating a high severity, while the EPSS score of less than 1% shows that exploitation is currently considered low probability. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly documented exploits are known. The likely attack vector is through crafted URLs or form inputs that manipulate the parameter used in the include/require statement, enabling an unauthenticated visitor to trigger the inclusion of local files.