The vulnerability is an improper control of filename for an include/require statement in the PHP code of the Immocaster WordPress Plugin, which allows an attacker to trigger a local file inclusion. The impact is that a malicious actor can read arbitrary files from the server’s file system, potentially leading to disclosure of sensitive data, credential compromise, or further exploitation. This weakness falls under CWE-98, indicating insecure handling of file operations in PHP.

The affected product is the Immocaster WordPress Plugin developed by Hinnerk Altenburg, versions up to and including 1.3.6. Users running any of these releases on a WordPress installation are susceptible to the vulnerability.

The CVSS score of 8.1 signifies high severity, and the EPSS score of less than 1% indicates a low but non-zero likelihood of exploitation in the wild at the time of analysis. The vulnerability is not listed in CISA KEV, suggesting that no known large-scale exploitation has been reported. The likely attack vector is remote, requiring the attacker to send a crafted HTTP request that manipulates the file path used in the include/require statement.