The vulnerability arises from an improper control of the filename used in PHP include/require statements in the Roxnor FundEngine plugin. This is a CWE-98 Local File Inclusion flaw. Based on the description, it is inferred that an attacker can supply a crafted filename that directs the application to include arbitrary local files, potentially leading to disclosure of sensitive server files or execution of arbitrary PHP code.

The affected systems are WordPress sites running the FundEngine / wp-fundraising-donation plugin, version 1.7.4 or earlier. The vendor is Roxnor. Any installation that has not upgraded beyond 1.7.4 is vulnerable.

The CVSS score of 7.5 classifies the flaw as high severity, and the EPSS score of less than 1% indicates a very low probability that it will currently be exploited. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack is local; an attacker would need access to the site’s input vectors that trigger the include statement. Once the flaw is triggered, it could read arbitrary files and may be leveraged for further compromise. Prompt patching is therefore advised.