The BRW plugin for WordPress contains an improper control of filename for include/require statements in PHP, classified as CWE-98. This flaw permits local file inclusion, which an attacker could exploit to read sensitive files or execute arbitrary PHP code, leading to confidentiality, integrity, or availability compromise. The vulnerability is limited to plugin versions 1.8.6 and earlier, but an attacker with web access could trigger it via user-supplied input.

Ovatheme’s BRW plugin, versions 1.8.6 and earlier, are affected.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests a low exploitation probability at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web request that allows an attacker to supply a file path parameter, resulting in local file inclusion.