The vulnerability is an improper control of filenames supplied to PHP include/require statements in the WPAdverts plugin. This flaw allows an attacker to locally include arbitrary files on the web server, potentially leading to disclosure of sensitive data or execution of malicious code if a specially crafted file is placed in the local file system. The weakness is tracked as CWE‑98 and is not a remote file inclusion flaw despite the name, as the attacker does not need external network access to the target server but must be able to influence the include path on the server.

The issue affects the WPAdverts plugin for WordPress released by Greg Winiarski version 2.2.2 and earlier. There are no specific sub‑versions beyond 2.2.2 mentioned; any site running those older releases is susceptible.

With a CVSS score of 7.5 and an EPSS below 1 %, this vulnerability poses a moderate to high risk but is considered relatively unlikely to be actively exploited in the wild. It is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The likely attack vector is local server exploitation, requiring the attacker to influence the include path through the plugin’s input controls – possibly via crafted query parameters or compromised user accounts that can upload files. Because the flaw does not rely on network authentication or remote code execution capabilities, the reasonable assumption is that it requires some level of access to the site’s backend or file system, which lowers the likelihood but also increases the value of remediation.