The vulnerability is an improper control of the filename used in PHP's include/require statements. An attacker who can influence this filename can read arbitrary local files or potentially execute code that resides on the server. This LFI flaw exposes sensitive data and, depending on the server configuration, can lead to remote code execution.

The issue affects the RealMag777 GMap Targeting WordPress plugin in version 1.1.6 and earlier. The plugin is installed in WordPress sites, so any site running a vulnerable version is at risk.

The CVSS score of 8.8 indicates high severity. The EPSS score of < 1% suggests current exploitation probability is low, and the vulnerability is not catalogued in CISA's KEV. The likely attack vector is a remote web-based request that can control the filename parameter, which the plugin does not properly sanitize. The weakness is CWE‑98.