The vulnerability is caused by improper control of the filename used in PHP include/require statements within the Paid Member Subscriptions plugin. The flaw allows an attacker to specify an arbitrary local file path through user input, enabling the inclusion of sensitive files or execution of malicious code. As a Local File Inclusion (CWE‑98) flaw, the attacker could read confidential configuration files or potentially execute arbitrary PHP code if a writable file is misdirected into the inclusion path.

Cozmoslabs Paid Member Subscriptions plugin for WordPress sites, in every version up to and including 2.15.4. Any WordPress installation running this plugin within the affected version range is susceptible and should be upgraded to a later release that fixes the code issue.

The CVSS score of 7.5 classifies this as high severity. The EPSS score of less than 1% indicates a very low probability of current exploitation, and it is not listed in the CISA KEV catalog. Because the flaw can be triggered through crafted web requests to the plugin, the overall risk remains significant for sites that host the vulnerable plugin.