An improper control of the filename used in a PHP include/require statement allows a local file inclusion vulnerability. Based on the description, it is inferred that an attacker could read or execute arbitrary files that should be inaccessible, potentially disclosing sensitive data or enabling execution of arbitrary PHP code. The flaw is classified as CWE‑98.

All installations of the Majestic Support WordPress plugin with versions up to and including 1.0.7 are affected. The vulnerability is present in every build from the plugin’s initial release through 1.0.7; no later versions are listed as vulnerable, so unpatched instances remain exposed.

The CVSS score of 7.5 indicates a medium‑to‑high severity. Based on the description, it is inferred that the flaw could allow remote code execution if a malicious PHP file is included. The EPSS score of less than 1 % suggests that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTTP request to the plugin that triggers the vulnerable include/require call, as inferred from the nature of the flaw.