The vulnerability is caused by improper validation of filenames used in PHP include/require statements within the SEUR Oficial WordPress plugin. This defect lets an attacker supply crafted input that causes the plugin to include arbitrary local files, which could be used to read sensitive configuration data or execute malicious PHP code. The impact includes disclosure of confidential information, alteration of web content, or full compromise of the affected WordPress site. The weakness is identified as CWE‑98, representing Improper Control of Filename for Include/Require.

Affected systems are installations of the SEUR Oficial WordPress plugin version 2.2.23 or earlier. The vendor is SEUR OFICIAL. The vulnerability applies to all WordPress sites that have the plugin active before upgrading beyond the stated version. No specific operating system dependency is mentioned, but the issue exists on any server running PHP with WordPress.

Based on the description, the likely attack vector is a crafted HTTP request to a WordPress page that loads the plugin’s include logic. The exploit requires only web access to the vulnerable site; no additional credentials are needed. Because the inclusion path is not sanitized, the attacker can specify a path to any file on the server, enabling data disclosure or execution of PHP code. While the EPSS score of 2% indicates a low exploitation probability, the simplicity of the attack path and high CVSS score mean that the vulnerability demands immediate attention, especially on exposed WordPress installations.