Improper control of the filename used in a PHP include/require statement allows an attacker to read any file on the local filesystem via the Popup Builder plugin. This flaw is classified as CWE‑98, Improper Control of Filename. This local file inclusion can lead to disclosure of sensitive data or, if an attacker can supply a path pointing to a PHP file, potentially execute arbitrary code on the server, compromising confidentiality, integrity, or availability of the affected WordPress site.

The vulnerability affects the GhozyLab Popup Builder easy-notify-lite plugin version 1.1.35 and all prior releases. Any WordPress site that installs or keeps this plugin at those versions is at risk.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of less than 1 percent suggests that exploitation is currently rare. The defect is not listed in the CISA KEV catalog. The likely attack vector involves an attacker who can influence the file path parameter used by the plugin, which could be done via a publicly accessible endpoint or by bypassing authentication if the plugin accepts input from non‑logged‑in users. Successful exploitation could result in local file reading or code execution.