Improper control of the filename passed to a PHP include/require statement in the Super Store Finder plugin allows an attacker to trigger a local file inclusion. This flaw means that a malicious user who can influence the include path could read arbitrary local files or execute unintended PHP code, leading to information disclosure or code execution on the affected WordPress site.

The vulnerability affects all installations of the WordPress Super Store Finder plugin by highwarden, specifically any version earlier than 7.8. Users running these versions should be aware that the plugin may expose local files to inclusion regardless of user permissions.

The CVSS score of 7.5 indicates a high severity vulnerability, but the EPSS score of less than 1% suggests that exploitation is currently unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to supply a crafted filename parameter to the plugin, meaning the attack is local to the web server environment. Without a path traversal fix, this could allow the reading of sensitive files or, if a PHP file is supplied, server‑side code execution.