The Capturly WordPress plugin contains a flaw where the filename given to a PHP include/require call is not validated, allowing an attacker to cause the server to include arbitrary local files. By triggering this vulnerability, an unauthenticated visitor can read files that the web server process can access, potentially leaking configuration data, credentials or other sensitive information. This weakness aligns with CWE‑98, which describes improper control of the filename used for file inclusion.

All WordPress sites that have the Capturly plugin version 2.0.1 or earlier are affected. The vulnerability applies to every installation because the flaw exists in the plugin code independent of the hosting environment, and no additional configuration changes are required for the issue to be exploitable.

The CVSS base score of 7.5 indicates high severity, while an EPSS score of <1% shows that exploitation is currently considered low probability. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly documented exploits are known at present. The likely attack vector is through crafted URLs or form inputs that manipulate the parameter feeding the include/require statement, enabling an unauthenticated visitor to trigger the inclusion of local files.