The License For Envato plugin contains an improper control of the filename used in a PHP include/require statement, enabling local file inclusion. This vulnerability allows an attacker to read arbitrary files from the server, and if the attacker can supply a file containing executable PHP code, it may lead to remote code execution. The weakness is categorized as CWE‑98.

The vulnerability affects the WordPress plugin License For Envato by Ashraful Sarkar Naiem, versions up to and including 1.0.0. No specific sub-versions beyond 1.0.0 are impacted; all earlier releases are also affected.

The CVSS score of 7.5 indicates a medium‑to‑high severity. The EPSS score of <1% indicates a low but non‑zero probability of exploitation at the moment. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTTP request that supplies a filename parameter to the plugin’s inclusion logic, enabling the attacker to read sensitive system files or execute malicious code if the web server allows PHP code execution from arbitrary files. No external conditions are required beyond the presence of the vulnerable plugin on a WordPress site.