The iRecco Core plugin for WordPress contains improper validation of filename parameters used in PHP include/require directives, which creates a Local File Inclusion flaw. An attacker who can influence these parameters can read arbitrary local files or execute code if the file is included by the application, potentially compromising the confidentiality, integrity, and availability of the site.

The affected product is the WebGeniusLab iRecco Core WordPress plugin, specifically versions up to and including 1.3.6.

The CVSS score of 8.1 indicates serious potential impact. The EPSS score of less than 1% suggests that the likelihood of exploitation at present is very low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web‑based; an unauthenticated or authenticated user could craft a URL or form submission that points the vulnerable parameter to a sensitive local file, enabling data disclosure or execution. Given the severity and the possibility of remote code execution, prompt remediation is advised.