The WP-Recall plugin contains an include/require statement that accepts a filename parameter without proper validation. An attacker can supply a crafted path that causes the plugin to load an arbitrary local file, allowing the attacker to read sensitive files such as configuration or log files. Based on the description, it is inferred that if the attacker supplies content that is later included as executable code, remote code execution could be possible. This vulnerability could thus compromise the confidentiality, integrity, and availability of the affected WordPress site.

All supported releases of the WP-Recall WordPress plugin up to and including version 16.26.14 are affected. The vulnerability applies to every installation that has the plugin downgraded to or running these versions.

The CVSS score of 7.5 indicates a high impact if exploited, while the EPSS score of less than 1% suggests that exploitation is not currently common. The vulnerability is not listed in the CISA KEV catalog. An attacker would typically trigger the flaw by sending a crafted request containing a malicious file path to the plugin’s include endpoint, which is accessible via normal web traffic. Based on the description, it is inferred that successful exploitation could expose sensitive data or allow code execution, posing a serious risk to confidentiality, integrity, and availability of the affected WordPress site.