Improper control of the filename supplied to a PHP include or require statement allows an attacker to invoke a local file inclusion vulnerability in the zamartz Checkout Field Visibility for WooCommerce plugin. This flaw can let the attacker read sensitive local files or, if a PHP file is included, execute arbitrary code, compromising confidentiality, integrity, and potentially availability of the affected WordPress site.

The vulnerability affects all installations of the zamartz Checkout Field Visibility for WooCommerce plugin with a version equal to or lower than 1.3.0. No specific patch version is listed, so any instance running version 1.3.0 or earlier is considered vulnerable.

The issue carries a CVSS score of 7.5, indicating a high severity. The EPSS score is <1%, implying that while exploitation is possible, it is considered unlikely at present, and the vulnerability is not reflected in the CISA KEV catalog. The likely attack vector is a local file inclusion path manipulation via an HTTP request to the plugin’s endpoint, which would enable an attacker to read arbitrary files and potentially execute code if a PHP file is chosen.