The vulnerability arises from improper validation of filenames in the include/require statements of the miniorange-discord-integration plugin. An attacker could supply crafted input that causes the plugin to read or execute arbitrary local files, potentially exposing sensitive data or enabling code execution on the server. This flaw corresponds to CWE‑98.

Affecting all installations of the miniOrange Discord Integration WordPress plugin up to and including version 2.2.2. The issue is present across all earlier releases, and no fix is available in those versions.

With a CVSS score of 8.1 the flaw is considered high severity, but the EPSS score of less than 1% indicates a very low likelihood of exploitation. Based on the description, the likely attack vector is inferred to involve supplying a malicious filename through a plugin endpoint. The vulnerability does not appear in the CISA KEV catalogue. Exploitation would typically require the attacker to supply a malicious filename value to the plugin’s file inclusion logic, which could be achieved through public endpoints or administrative interfaces of the WordPress site. No authentication is explicitly required, but the exact attack path depends on how the plugin is exposed.