Technical impact
The vulnerability is an improper control of the filename used in an include/require statement in PHP, allowing local file inclusion. An attacker could supply a crafted path to read arbitrary files from the server, potentially exposing configuration files, keys or other confidential data. If the included file contains executable code, it may enable further compromise of integrity or even local code execution for the web server user.
Affected Systems
WordPress sites that have the Easy Invoice plugin from MatrixAddons installed. All versions from the initial release through 2.1.4 are affected; the vulnerability remains present in any version up to and including 2.1.4.
Risk and Exploitability
The CVSS score of 6.6 indicates a medium severity impact. The EPSS score of less than 1 percent suggests that exploitation is unlikely to be widely observed, and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector involves an unauthenticated user sending a crafted URL or parameter that causes the plugin to include a local file; this inference is based on the LFI description and is not directly stated in the advisories. Successful exploitation would compromise confidentiality and potentially integrity of the affected WordPress installation.
