The vulnerability arises from improper control of the filename used in a PHP include/require statement within the Funnel Builder by FunnelKit plugin. An attacker who can make the plugin resolve a crafted filename may cause the server to include any local file. If the attacker supplies a file containing PHP code, execution on the web server can result, leading to remote code execution or sensitive data disclosure. The weakness is identified as CWE-98 and is represented by a CVSS score of 7.5.

The issue affects the Aman Funnel Builder by FunnelKit plugin on WordPress installations with versions up to and including 3.11.1. No additional product versions are listed, and no common platform enumeration strings are available.

The EPSS score is less than 1%, indicating that the likelihood of global exploitation is currently low, yet the CVSS score of 7.5 signals a moderate to high risk if an adversary succeeds. The vulnerability is not currently listed in the CISA KEV catalog, so it has not been confirmed as widely exploited. The attack vector is likely an unprivileged or authenticated user who can send a request to a plugin endpoint that processes the filename parameter. If the local filesystem is improperly configured, the attacker could also read sensitive files, but direct code execution requires inclusion of a PHP file.