The vulnerability arises from improper handling of the filename used in PHP include/require statements. An unauthenticated attacker can cause the plugin to load arbitrary local files, which may lead to reading sensitive data or executing malicious code. This weakness corresponds to CWE-98 and can allow full remote code execution on the affected WordPress site.

The affected product is StylemixThemes Motors – Events, a WordPress plugin. Versions up through 1.4.7 are vulnerable; the issue exists from the earliest release through these versions. Any site running one of these versions on a WordPress installation is at risk.

The CVSS score of 9 indicates critical severity, while the EPSS score of less than 1% suggests low current exploit probability. The vulnerability can be triggered without authentication, making it highly dangerous. Because the flaw allows inclusion of local files, an attacker could potentially run arbitrary PHP code, exfiltrate data, or compromise the entire WordPress environment. The risk is further elevated by the lack of a CISA KEV listing, indicating no known active exploitation, but the severity warrants immediate action.