The vulnerability is a PHP Local File Inclusion flaw that arises from improper control of the filename used in an include or require statement. This weakness can allow an attacker to cause the application to read or execute arbitrary local files, which, depending on the environment, could lead to disclosure of sensitive data or execution of malicious code within the WordPress site.

CEDCommerce Integration for Good Market plugin for WordPress, versions from the earliest released versions up through version 1.0.6.

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% shows a low but non‑zero expected exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could construct a crafted request that causes the plugin to include a local file, which may require either a local attacker or a remote attacker with the ability to trigger the vulnerable include path. Further exploitation could depend on file permissions and the presence of writable files that can be turned into executable scripts.