The vulnerability is a classic PHP Local File Inclusion flaw caused by improper control of file names used in include/require statements, identified as CWE-98. An attacker could exploit this weakness to read arbitrary files on the server or trigger unintended PHP code execution. The CVSS score of 8.1 reflects a high severity that can compromise confidentiality, integrity, and availability of the affected WordPress site.

The flaw is present in SolverWp's Portfolio Builder plugin for all releases from the earliest available version up to and including 1.2.5. No specific version sub‑ranges are listed, so any installation using the plugin at or before 1.2.5 is considered vulnerable.

The EPSS score less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the high CVSS score signals that once discovered, an exploit could have severe impact. Based on the description, it is inferred that attackers would target the plugin by constructing requests that manipulate the file name parameter used by the include/require call, potentially from any authenticated or unauthenticated endpoint exposed by the plugin. Successful exploitation would enable reading sensitive local files or executing arbitrary PHP code within the web application context.