The flaw arises from improper control of filenames used in PHP include/require statements within the Simple Contact Forms plugin. An attacker can supply a crafted input that the plugin uses for file inclusion, enabling inclusion of local files such as configuration files or arbitrary PHP scripts. This can result in unauthorized data disclosure or potentially execution depending on what is included. The weakness maps to CWE‑98, reflecting insufficient validation of user‑supplied file paths.

All releases of the WordPress Simple Contact Forms plugin up to and including version 1.6.4 are affected. WordPress sites that have installed any of these versions are vulnerable.

The CVSS base score of 8.1 indicates high severity. The EPSS score of less than 1% implies that the likelihood of exploitation in the wild is currently low, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can craft a request that directs the vulnerable plugin to include arbitrary local files, potentially leading to code execution or sensitive data exposure. The CVE description does not mention authentication requirements; it is inferred that an attacker could eliminate authentication for exploitation.