An improper handling of filenames in PHP include/require statements within the WP Travel Gutenberg Blocks plugin allows an attacker to construct a request that forces the server to read or execute an arbitrary local file. This flaw can lead to the exposure of sensitive configuration data, code execution, or other unintended disclosure of server resources. The weakness corresponds to CWE‑98, Improper Control of Filename for Include/Require Statement.

The vulnerability is present in all released versions of WP Travel Gutenberg Blocks up to and including 3.9.0, distributed by WP Travel. Any WordPress site that has not upgraded past version 3.9.0 is potentially exposed.

The CVSS score of 8.1 classifies the problem as high severity. The EPSS score of less than 1% indicates a low likelihood of exploitation in the short term, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves an attacker sending a crafted request that triggers the plugin to include an arbitrary local file; the description does not specify an authentication requirement, so unauthenticated users may be able to exploit the flaw if block parameters can be manipulated.