The vulnerability is an improper control of the filename used in a PHP include/require statement within the nicdark Hotel Booking plugin. It allows a local file to be included based on user input, which can expose configuration files, source code, or any readable file on the server. If a file containing executable PHP code can be included, it may lead to remote code execution. The weakness is identified as CWE‑98.

WordPress sites running the nicdark Hotel Booking plugin (nd‑booking) version 3.6 and earlier are affected. Any installation of the plugin installed in a WordPress environment without a newer patch is vulnerable.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests that exploitation occurrences are currently rare, and the vulnerability is not listed in CISA’s KEV catalog. Inference: An attacker can likely trigger the inclusion by sending a crafted request to a URL parameter that supplies the include path. The attack could be performed by an unauthenticated user if the vulnerable endpoint is publicly accessible. Successful exploitation would grant the attacker read access to arbitrary local files and potentially execute malicious code.