An improper validation of filenames used in a PHP include/require call within the Opinion Stage Poll, Survey & Quiz Maker Plugin allows an attacker to request inclusion of arbitrary local files. The flaw is a classic PHP Local File Inclusion, exposing the server’s local filesystem to disclosure of files such as configuration, credentials, or other sensitive data. The vulnerability is classified as CWE‑98 and does not provide direct remote code execution but can enable attackers to read or execute files that the web server can access.

The affected software is the WordPress plugin Opinion Stage Poll, Survey & Quiz Maker Plugin, version 19.11.0 and older, present in the WordPress ecosystem. Any site using this plugin within the specified build range is at risk.

The CVSS v3 score of 7.5 indicates a high impact severity, while the EPSS score of <1% suggests that current exploitation activity is low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local file inclusion via the plugin’s file upload or options interfaces, typically requiring a user with administrative privileges or the ability to influence the filename parameter. No known public exploits have been reported, but the isolation of the issue to the plugin and the absence of mitigations in the code imply that an authenticated attacker could leverage it to read or potentially execute files on the server.