Improper control of the filename used in an include or require statement in the miniOrange WordPress Social Login and Register plugin allows a Local File Inclusion flaw, which can enable an attacker to read arbitrary files from the server and potentially execute code. This weakness is classified as CWE‑98 and can compromise the confidentiality, integrity, or availability of the web application if exploited.

The vulnerability affects the miniOrange WordPress Social Login and Register plugin for WordPress. All installations using version 7.6.10 or earlier are impacted. No other sub‑versions have been reported as vulnerable.

The CVSS score of 8.1 indicates high severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. It is not listed in the CISA KEV catalog, implying no known active exploits. Based on the description, the likely attack vector is a local web request that manipulates the include path. An attacker who can influence the input controlling the filename may read sensitive configuration files or include attacker‑controlled code, potentially leading to remote code execution or data exposure.