Premmerce Product Search for WooCommerce suffers from an improper control of filenames used in include/require statements, enabling a local file inclusion flaw. An attacker that can influence the filename passed to the PHP include may read arbitrary files on the web server, potentially exposing configuration data or credentials. If the application later executes the included file, remote code execution could also be achieved, especially if an attacker can upload or craft a PHP file accessible via the inclusion path.

The vulnerability affects the Premmerce Product Search for WooCommerce plugin for WordPress, specifically all releases from its inception up through version 2.2.4. Users employing any of these plugin versions remain at risk.

The CVSS base score of 7.5 indicates a high impact when exploited, and the EPSS score of less than 1% suggests a low current exploitation probability. The flaw is not listed in CISA KEV, but the potential for local file read and remote code execution warrants prudent action. Attackers can trigger the inclusion by manipulating request parameters within the plugin’s search interface, typically from a web-accessible location.