The vulnerability originates from an inadequate check on the filename used in a PHP include/require statement within the National Weather Service Alerts plugin. This flaw allows an attacker to include arbitrary local files, which could lead to the disclosure of sensitive information or the execution of unintended PHP code. The weakness aligns with CWE‑98 and is scored 8.1 on CVSS, indicating high severity.

The National Weather Service Alerts plugin for WordPress, developed by John Russell, is affected for all releases up to and including version 1.3.5. Any installation that has 1.3.5 or an earlier version is considered vulnerable.

The EPSS score of less than 1% suggests the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. The inferred attack vector is a remote URL parameter that the plugin processes, which could be abused to reference local filesystem paths. No public exploit has been reported, so the risk remains primarily theoretical until confirmed by an attacker. The high CVSS score indicates that, if exploited, the impact could be substantial for the affected site.