The vulnerability is an improper control of filename for include/require in the Acato WP REST Cache plugin, enabling PHP Local File Inclusion. This flaw can allow an attacker to read arbitrary files from the server, potentially exposing sensitive configuration, credentials, or other confidential data. The issue is classified as CWE‑98 and carries a CVSS score of 7.5, indicating a moderate to high severity level.

Affected components are the Acato WP REST Cache plugin for WordPress. All releases from the first version through and including 2025.1.0 are vulnerable; any instance of the plugin running up to version 2025.1.0 is at risk.

The low EPSS score (<1%) suggests exploitation frequency is currently low, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is likely exposed through the plugin's REST API endpoint, and the lack of explicit authentication requirements in the description implies that unauthenticated or low‑privilege users could craft requests to trigger file inclusion. Once exploited, the attacker may read sensitive files, resulting in a confidentiality breach. With a CVSS score of 7.5, which indicates moderate to high severity, the potential impact is significant if the vulnerability is leveraged stealthily over time.