The GamiPress plugin contains a flaw where the filename used in the PHP include/require statement is not properly sanitized. This improper control of file names (CWE‑98) allows an attacker to request the plugin to include arbitrary local files. If an attacker can supply a path that points to a file containing executable code, the plugin may execute that code, leading to potential compromise of the WordPress instance.

The vulnerability affects the GamiPress plugin distributed by Ruben Garcia, specifically versions up to and including 7.3.7. Versions beyond 7.3.7 are not affected by this issue.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA KEV. The likely exploitation path is through the plugin's file inclusion mechanism, which an attacker may manipulate by supplying crafted parameters while authenticated or abusing the plugin's internal functions. The description implies that the attack involves user‑controlled input to override the filename, thereby inferring the attack vector as local file inclusion. Successful exploitation could result in arbitrary code execution on the server if a malicious local file is included.