The Store Exporter plugin processes filenames supplied to PHP include and require statements without proper validation, permitting an attacker to specify arbitrary local file paths. This flaw enables Local File Inclusion (LFI) that could expose sensitive configuration files or other server data. The vulnerability is classified as CWE-98. The description does not mention that executing included code is possible, but it is inferred that if an attacker could write a PHP file to a directory that the plugin includes, that file might execute.

WordPress sites that have the Josh Kohlbach Store Exporter plugin installed, in any version up through 2.7.6, are affected. Site administrators should verify the plugin version and that the plugin resides in the standard wp‑content/plugins directory under the expected path.

The CVSS base score of 7.5 indicates high severity. The EPSS score of < 1 % reflects a low but non-zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to influence a file path parameter, typically through the plugin’s export interface or a crafted URL. The likely attack vector is client input to the plugin’s export module. An attacker who can supply a file path can read arbitrary files or, if file creation is possible, include a malicious PHP file that may execute.