The flaw arises from insufficient validation of the filename passed to PHP’s include/require functions. Based on the description, it is inferred that an attacker who can influence the include path can cause the server to load arbitrary local files, including configuration files or files in the web root. If the included file contains PHP code, execution of that code can lead to remote code execution. The weakness is categorized as CWE‑98.

The Schiocco Support Board WordPress plugin, versions up to and including 3.8.0, is vulnerable. WordPress sites that have this plugin installed and activated are potentially exposed.

With a CVSS base score of 8.1, the flaw is high severity, but its EPSS score of less than 1 % indicates exploitation is currently unlikely to be widespread. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers can influence the include path through a URL parameter or form input; exploiting this can read sensitive files or, if a PHP file is included, achieve remote code execution, compromising confidentiality, integrity, and availability.