The flaw, a CWE‑98 (Improper Control of Filename for Include/Require Statement), allows an attacker to influence the filename used in a PHP include or require call, giving the ability to read or execute arbitrary files residing on the web server. This local file inclusion can expose sensitive configuration data, credentials, or other private files. If the attacker can supply a code‑containing file, the impact could extend to code execution, though the description focuses on file inclusion.

The vulnerability impacts the WPCOM Member plugin from vendor Lomu for WordPress, affecting all releases up to and including version 1.7.7. Versions 1.7.8 and later are not affected.

The CVSS score of 8.8 signals a high severity, while the EPSS score of 2% indicates that exploitation is somewhat more likely than before. The flaw is not listed in the CISA KEV catalog, so no widespread exploitation has been reported. The likely attack vector is a crafted URL or form input that controls the include path, as is typical for local file inclusion scenarios. Successful exploitation could lead to data disclosure or, in a worst‑case scenario, remote code execution if the attacker can upload or reference a malicious script.