This vulnerability is an improper control of filename for the include/require statement in the PHP code of the Product Lister for eBay plugin. It is a Local File Inclusion flaw identified as CWE‑98 that can allow an attacker to read or execute arbitrary files on the web server’s filesystem, potentially enabling further compromise of the WordPress site.

The affected product is cedcommerce Product Lister for eBay (plugin name product‑lister‑ebay) for WordPress. Versions from the earliest release through and including 2.0.9 are vulnerable, with no later releases documented as affected.

The CVSS score is 7.5, indicating a high severity impact. The EPSS score is below 1% showing a very low likelihood of exploitation today, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, where a crafted HTTP request to the plugin’s exposed endpoint can trigger the inclusion of a local file. Because the include filename is not properly sanitized, the attacker can specify arbitrary local paths on the server, potentially exposing sensitive configuration files or executing arbitrary PHP code if a server‑side script is included.