The vulnerability is an improper control of filename used in a PHP include/require statement, allowing a local file inclusion flaw. By manipulating the filename, an attacker could read arbitrary files on the server, gaining access to configuration data, credentials, or even executing PHP code if a malicious file is included. This flaw falls under CWE-98 and threatens the confidentiality and integrity of the host system.

The affected product is the WordPress Essential Real Estate plugin provided by G5Theme (g5plus). Any installation using a version from the earliest release up to and including 5.2.9 is vulnerable. The plugin runs within WordPress sites that have the plugin activated.

The CVSS score of 8.1 indicates high severity, yet the EPSS score is less than 1%, suggesting a low probability of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. An attacker would typically craft a request containing a malicious filename parameter to trigger the vulnerable include, which could succeed if the site’s PHP configuration permits such operations. While no public exploit is confirmed, the low EPSS does not rule out targeted attacks, and the potential for remote code execution via included files elevates the risk. Maintaining a cautious posture through prompt patching is advised.