The Fat Services Booking plugin contains an include or require call that immediately uses a filename derived from user input or configuration without proper validation or sanitization. This flaw allows an attacker to specify an arbitrary path on the server’s filesystem, leading the application to read and execute that file. The weakness is classified as CWE‑98, which describes improper control of a filename used in a file inclusion statement.

WordPress sites that have the roninwp FAT Services Booking plugin version 5.5 or earlier installed are affected according to the CNA disclosure. Sites using any newer release are not listed as vulnerable.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at the time of the report. The vulnerability is not included in the CISA KEV catalog. The most likely attack vector is a web‑based request that manipulates the plugin’s filename parameter or configuration value, but the exact exploitation method is not detailed in the advisory, so this inference is drawn from typical LFI patterns in WordPress plugins.