The FW Gallery WordPress plugin contains an improper control of filenames for PHP include/require statements, a vulnerability classified as CWE‑98. Because the plugin accepts user‑supplied input to determine the file path passed to PHP’s include/require functions, an attacker may force the plugin to include arbitrary local files on the server. If the attacker can place PHP code in a location that the plugin can read, the server will execute that code, potentially giving the attacker full control over the web host.

All releases of the FW Gallery plugin up through version 8.0.0 are affected. Any WordPress site running the plugin at version 8.0.0 or earlier is vulnerable, regardless of other plugins or core WordPress version.

The CVSS base score of 8.1 indicates high severity, and an EPSS score below 1% suggests exploitation is currently rare. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a crafted URL or form submission that influences the filename parameter sent to the plugin, which is inferred from the description. Successful exploitation would give the attacker the ability to execute arbitrary PHP code with the privileges of the web server.