The vulnerability is due to improper validation of a filename before it is included in PHP code. This flaw allows an attacker to supply an arbitrary path in a request that is processed by WP Chill Download Monitor and can result in local files being read or executed. The weakness is classified as CWE‑98, and if an attacker is able to manipulate the include path, the local inclusion can lead to disclosure of sensitive data or execution of malicious code on the server.

The issue affects the WordPress Download Monitor plugin with versions from the earliest release through 5.0.22. System administrators should check whether any site installs this plugin and whether it is in a vulnerable version.

The CVSS score of 7.5 reflects a high impact for a local file inclusion flaw. The EPSS score is below 1 %, indicating that exploitation is considered rare but not impossible; it does not appear in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated HTTP request that supplies a crafted file name, which the vulnerable plugin will process with an insecure include. This attack does not require elevated privileges, but the target must be accessible from the Internet. Monitoring and limiting inbound traffic to the vulnerable download URLs can reduce the attack surface.