Improper control of filenames in a PHP "include/require" statement allows an attacker to read or execute files from the local filesystem. The vulnerability, classified under CWE‑98, can expose sensitive server files such as configuration or credentials, and in some cases may enable remote code execution if the attacker can supply a PHP file. The impact is confined to the file system of the hosting server and can compromise confidentiality, integrity, or availability for the affected site.

WordPress sites that have installed the Széchenyi 2020 Logo plugin up to and including version 1.1 are affected. Users should check that no older, patched versions are in use.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score is reported as less than 1%, suggesting that exploitation attempts are currently rare. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a local file inclusion via a plugin parameter that accepts file paths; exploitation would require the attacker to supply a crafted value to the plugin’s filename variable, enabling access to arbitrary files on the server. Because the plugin does not enforce strict path validation or whitelist checks, the risk of successful exploitation is moderate but significant when the plugin is exposed to unauthenticated users or administrative input.