The Uxper Booking plugin has an improper control of filenames used in PHP include and require statements, permitting local file inclusion. An attacker who can influence the filename path may read arbitrary files from the server, potentially exposing configuration data, credentials, or other sensitive information. The weakness is classified as CWE‑98, and the impact is confidentiality leakage rather than code execution in the information provided.

WordPress sites using the Uxper Booking plugin version 1.3.3 or earlier are affected. The issue applies to all releases from the earliest available version up to and including 1.3.3.

The CVSS score of 8.1 flags this as a high‑severity vulnerability. The EPSS score is less than 1%, indicating a very low probability of exploitation at this time, and it is not listed in the CISA KEV catalog. The likely attack vector is local file inclusion, usually triggered via unsanitized input controlling the filename; if the plugin allows input from an external user, a remote attacker might prepare a request to trigger the inclusion. Exploitation would generally require the attacker to be able to dictate the path or to access a file that can be traversed. Given the high CVSS score, any successful exploitation would allow an attacker to read sensitive data and compromise the confidentiality of the affected site.