The vulnerability is caused by improper validation of filenames used in PHP include/require statements within the Cena Store plugin. An attacker who can provide a crafted path could cause the plugin to include arbitrary local files, which may enable reading sensitive data or executing code in the PHP context. The description indicates that the inclusion is performed locally, so the attack vector is likely local and may require access to the plugin interface.

The issue affects the thembay Cena Store WordPress plugin for versions 2.11.26 and earlier. All installations of these versions are vulnerable whenever the plugin is active.

The CVSS score of 8.1 places the issue in the high severity range. The EPSS score is below 1 %, indicating a low probability of exploitation at present. It is not listed in CISA’s KEV catalog. Exploitation would require an attacker to supply a file path that the plugin accepts for inclusion; such a path is likely obtained via a local plugin interface and is therefore inferred rather than guaranteed.