Improper control of filenames in the WPAMS apartment-management plugin allows a local file inclusion that can be exploited by an authenticated user to load arbitrary PHP files. The attacker can execute code in the context of the web application, resulting in privilege escalation. This flaw is identified as CWE‑98 and scored with a CVSS of 9.8.

All installations of the WPAMS plugin version 44.0 or earlier. The issue originates from the plugin's inclusion logic and affects every instance of the plugin from its earliest release up to the stated maximum version.

The CVSS score of 9.8 indicates a critical level of severity. The EPSS score is less than 1 percent, suggesting a low current exploitation probability but the vulnerability remains severe. Because it is not listed in CISA KEV, no known exploitation has been reported, but the local file inclusion attack could be executed by users with sufficient plugin permissions. The likely attack path is an authenticated administrator exploiting the plugin’s file inclusion functionality to reference arbitrary system files, directing the server to include malicious code.