This vulnerability results from improper handling of filename values in PHP include statements, allowing attackers to request arbitrary local files on the server through the WerkStatt Plugin. The flaw can lead to disclosure of sensitive configuration files, credentials, or, if an attacker can supply a PHP file, remote execution of arbitrary code. It is classified as CWE‑98, a weakness in file inclusion control.

The affected product is Fuelthemes WerkStatt Plugin, versions from the initial release up through 1.6.6. Any installation using a version equal to or older than 1.6.6 is vulnerable.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The most probable attack vector is a remote web attacker submitting a specially crafted HTTP request that exploits the inclusion flaw. Successful exploitation could allow an attacker to read arbitrary files or execute code if coupled with other weaknesses.