The vulnerability stems from improper control of the filename in PHP include/require statements, allowing an attacker to influence the file path that the Favorites plugin loads. This flaw falls under the input validation weakness identified as CWE‑98 and can lead to Local File Inclusion. If an attacker supplies a crafted request, they could read sensitive files on the server and, in worst case, execute arbitrary code if the included file contains executable payloads.

The affected product is the WordPress Favorites plugin developed by Kyle Phillips. Versions from the initial release through 2.3.6 are susceptible to the Local File Inclusion flaw. Users running any of these versions are at risk when the plugin processes untrusted filenames.

The CVSS score of 7.5 indicates a high severity for this LFI flaw. However, the EPSS score of <1% reflects a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a request that directs the plugin to include an unintended local file. While no specific exploitation proof‑of‑concept is documented, the nature of LFI makes remote code execution a theoretical possibility if the attacker can write files to the server or influence included scripts.