The plugin contains an improper control of the filename used in an include/require statement, allowing a local file inclusion vulnerability. An attacker who can influence the filename parameter could cause PHP to load arbitrary files from the server, potentially exposing sensitive configuration data, credentials, or enabling arbitrary code execution if executable files are included. The flaw falls under CWE‑98.

RadiusTheme Widget for Google Reviews, version 1.0.15 and earlier. The issue affects all installations of the plugin that have not been updated beyond that version.

The CVSS score of 8.1 indicates high severity, but the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Likely attack requires local access or an authenticated administrator who can provide a crafted filename in an include request, after which an attacker could cause PHP to read arbitrary files or include remote code if misconfigured.