The vulnerability is a PHP Local File Inclusion flaw caused by insufficient validation of filenames used in include/require statements in the WordPress Cloud SAML SSO - Single Sign On Login plugin. This flaw could allow an unauthenticated user to read arbitrary files on the server or potentially execute local code, violating confidentiality and integrity of the application.

The Cloud SAML SSO plugin for WordPress, registered under Cloud Infrastructure Services, is affected in all released versions up to and including 1.0.18. The vulnerability to any installation of the plugin from its earliest version through 1.0.18.

The CVSS base score is 7.5, indicating a high severity impact. The EPSS score is below 1%, suggesting a low but non‑zero probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is a local web request to the plugin’s code path that accepts a user‑controlled filename parameter. Exploitation would require only a simple HTTP request; therefore the risk is mitigated primarily through prompt patching and mitigating controls such as disabling the plugin or restricting directory access.