The Modal Survey plugin for WordPress contains an improper control of the filename used in PHP’s include/require statements. This flaw allows an attacker to manipulate the filename parameter to cause the plugin to load arbitrary files from the server, potentially exposing sensitive configuration data or executing malicious code. The vulnerability is classified as a remote file inclusion (CWE‑98) and can compromise confidentiality, integrity, or availability depending on the server context.

The affected product is the Modal Survey plugin developed by pantherius. All releases from the earliest available version through 2.0.2.0.1 are vulnerable. No higher version was explicitly addressed in the advisory.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% reflects a low likelihood of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector likely requires a publicly accessible WordPress site running the Modal Survey plugin; an attacker could craft a request to trigger the inclusion of a malicious file and achieve code execution or data disclosure.