The vulnerability arises from improper validation of filenames used in PHP include/require statements within the svil4ok Meta Keywords & Description plugin. The flaw allows local file inclusion, which can enable an attacker to read sensitive files or potentially execute arbitrary PHP code if crafted correctly, resulting in a breach of confidentiality, integrity, or availability. The weakness corresponds to CWE‑98.

Affected WordPress sites that have installed the svil4ok Meta Keywords & Description plugin at version 0.8 or earlier. No specific PHP or WordPress version requirements are mentioned, so any WordPress deployment with the vulnerable plugin is impacted.

The CVSS score of 7.5 indicates a high severity, but the EPSS score is under 1%, suggesting a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker could potentially trigger the inclusion by sending a crafted request to the plugin’s include endpoint; however, the precise authentication prerequisites are not disclosed, so it is inferred that either any visitor or a privileged user could exploit it depending on the plugin’s exposure.