The flaw arises from an improper specification of the filename used by PHP's include/require statements. An attacker can supply a crafted path in a request to the Smart Agreements plugin, causing the server to include an arbitrary local file. This allows the attacker to read application files such as configuration files, credentials, or other sensitive data stored on the filesystem. While the CVE description does not explicitly state that execution of malicious PHP code is possible, the inclusion of a local PHP file could lead to remote code execution; this is an inferred consequence based on typical LFI behavior.

The Smart Agreements WordPress plugin, provided by teamzt, is vulnerable in all releases from the earliest through version 1.0.3. Any WordPress installation deploying this plugin with a version number <= 1.0.3 is affected.

The CVSS score of 7.5 categorizes the issue as high severity. The EPSS score of less than 1% suggests that exploit activity is expected to be rare at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely via a public web request that triggers the plugin’s include logic; the plugin’s interaction with user input provides a straightforward path for exploitation. Successful exploitation would grant the attacker read access to local files, and potentially execution of PHP code if the attacker includes a crafted PHP file, though this latter outcome is inferred and not guaranteed by the CVE description.