The vulnerability is an improper control of the filename used in an include/require statement within the Saleswonder Team: Tobias CF7 WOW Styler plugin for WordPress. An attacker could supply a crafted filename that is included by PHP, allowing the read of arbitrary local files or the execution of code residing on the server. This weakness may lead to data disclosure, credential theft, or execution of malicious PHP code, compromising the confidentiality, integrity, and availability of the affected site.

The flaw affects CF7 WOW Styler plugins from the earliest version listed through 1.7.2. The plugin is distributed by the Saleswonder Team: Tobias and is used by WordPress sites that have installed it.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low current probability of exploitation, and the issue is not listed in the CISA KEV catalog. The likely attack vector is local to the web application; an attacker would need to trigger the vulnerable include path, which may be possible from a logged‑in user with sufficient privileges or via an unauthenticated request that reaches the plugin’s endpoint. No special conditions are described beyond the inclusion of an arbitrary file name.