The flaw arises from inadequate validation of file names used in PHP include/require statements within the WP shop plugin. An attacker who can influence the input that determines the file path can trigger the plugin to include arbitrary local files. This may expose sensitive information or, if the attacker can provide a malicious file, allow execution of arbitrary PHP code within the application. The weakness maps to CWE‑98, which covers improper controls over the filenames that are processed by program code.

The vulnerability exists in the WP shop plugin developed by Agence web Eoxia – Montpellier for WordPress sites. All releases from the earliest available version up to and including version 2.6.1 are affected. Site administrators using this plugin should check the installed version and apply remediation steps promptly.

The CVSS score of 7.5 reflects a high severity potential impact. Exploitation requires an attacker to supply a crafted filename that the plugin will include; the probability of exploitation is currently low, with an EPSS score of less than 1%. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is that an attacker gains control over the filename used in an include or require call, possibly via a form field or query parameter exposed by the plugin.