The Premmerce Wishlist for WooCommerce plugin contains an improper control of filename for include/require statements that allows a local file inclusion attack. An attacker can supply a crafted request that causes the plugin to include arbitrary files from the web server. The vulnerability is identified as CWE‑98 and can expose sensitive data such as configuration files or credentials.

Premmerce Wishlist for WooCommerce plugin version 1.1.10 and earlier, installed on WordPress sites.

The CVSS score is 7.5, indicating high severity, while the EPSS score is less than 1%, suggesting low current exploitation likelihood. The vulnerability is not listed in CISA KEV, reducing immediate threat perception. Likely attack vectors involve local requests to the WordPress site that supply a malicious filename via plugin parameters, potentially enabling an attacker to read any file that the web server can access. Due to the ability to read arbitrary files, the impact includes potential confidentiality loss and the foundation for further post‑exploitation activity.