An improper control of the filename used in a PHP include/require statement allows local file inclusion, enabling an attacker to read arbitrary files on the server through the WordPress JobSearch plugin. The vulnerability can be exploited to exfiltrate configuration files, database credentials, or other sensitive data, and may lead to code execution if a PHP file is read and executed. The core weakness is a lack of input validation on include paths, identified as CWE-98.

The CVE affects the eyecix WordPress JobSearch plugin in all versions prior to 3.0.8, including the recent 2.9.0 release referenced in advisory links. Any WordPress installation utilizing this plugin without the patch is vulnerable.

The CVSS score of 7.5 indicates a high impact vulnerability, while the very low EPSS score of less than 1% suggests current exploitation likelihood in the wild is low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a crafted request to the plugin that supplies a controlled filename parameter, triggering the include operation with an arbitrary path.