Premmerce Premmerce plugin allows PHP Local File Inclusion by improperly controlling the filename used in an include/require statement. This flaw enables an attacker to read arbitrary files from the server or, if the local file includes executable code, to execute that code within the context of the web application. The potential confidentiality impact is significant, while the integrity impact could extend to code injection if the attacker supplies malicious local files.

All installations of the Premmerce WordPress plugin with a version number of 1.3.19 or earlier are affected. No specific WordPress core version is required; the vulnerability resides entirely within the plugin code.

The CVSS score of 7.5 indicates a high risk level, but the EPSS score of less than 1% suggests that this vulnerability is currently exploited with low frequency. It is not listed in CISA KEV. The likely attack vector is via user-controlled parameters that influence the filename in the include statement; in the absence of explicit information, it is inferred that the vulnerability could be triggered through a crafted URL or input form that passes an arbitrary or local path.