The Simple Payment plugin contains a flaw where an attacker can supply an arbitrary filename to a PHP include/require statement without proper validation. This control of the include path means the attacker may read any file accessible to the web server, such as configuration files, or, if the PHP setting allow_url_include is enabled, execute code from a remote source. The vulnerability maps to CWE‑98 and can result in data exposure and the potential for executing malicious code on the host.

The flaw is present in all releases of the Simple Payment plugin by Ido Kobelkowsky up to and including version 2.4.6. System administrators running any of those versions of the plugin on WordPress installations are affected.

The CVSS score of 7.5 indicates a high-impact vulnerability; however, the EPSS score of <1% suggests that exploitation of this issue is currently uncommon. The plugin is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote web request that includes a manipulated parameter to trigger the vulnerable include. Compromise would require web access to the site and could result in information disclosure or remote code execution if additional server misconfigurations exist.