The vulnerability is an improper control of the filename used in PHP include/require statements, classified as CWE‑98. By exploiting this flaw, an attacker can cause the plugin to read arbitrary files on the server, potentially revealing sensitive configuration data or enabling remote code execution if privileged files are accessible.

The WooCommerce Store Toolkit plugin developed by Josh Kohlbach, specifically all releases through version 2.4.3, are affected. Users running any of these versions on a WordPress site are at risk.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated or low‑privilege attacker manipulating a filename parameter via a crafted URL or form submission directed at the plugin’s file‑inclusion endpoint. Successful exploitation would provide the attacker with access to arbitrary local files and, in worst cases, the ability to execute malicious code.