The vulnerability is an improper control of filename for include/require in PHP (CWE‑98). It allows an attacker to instruct the plugin to include arbitrary local files, which can lead to disclosure of sensitive configuration information or, in some cases, execution of arbitrary PHP code. The impact therefore includes confidentiality, integrity, and potentially availability risks to the affected WordPress site.

The flaw affects the miniOrange WordPress Social Login and Register plugin for WordPress, versions from the initial released version through 7.7.0. Any WordPress site that has this plugin installed and has not upgraded beyond 7.7.0 is vulnerable.

The CVSS score of 6.6 indicates moderate severity. The EPSS score of less than 1% shows a low probability of exploitation at the time of the assessment, and the issue is not listed in the CISA KEV catalog. The likely attack vector is remote, where an attacker sends a crafted request that manipulates the include path within the plugin’s login or registration flow. Successful exploitation could allow the attacker to read system files or execute PHP code on the server.