The vulnerability lies in improper validation of filenames used in PHP include/require statements within the Task Manager plugin. An attacker could exploit this flaw to read or execute local files on the server, potentially exposing sensitive configuration data or facilitating code execution if a malicious file is supplied.

Affected systems are installations of the Agence web Eoxia – Montpellier Task Manager plugin for WordPress, with vulnerability present in all versions up to and including 3.0.2. Users running Task Manager 3.0.2 or earlier are at risk.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at this time. The vulnerability is currently not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted HTTP request that supplies a malicious file path to the plugin, and an attacker can trigger the inclusion of local files. Without additional context, it is unclear whether authentication is required, so the potential impact ranges from data disclosure to remote code execution.