The plugin contains an improperly controlled filename in a PHP include/require statement, allowing an attacker to trigger local file inclusion. This flaw can enable the attacker to read arbitrary files on the server and, if PHP code is executed from a local file, can lead to full compromise of the WordPress site. The weakness is classified as CWE‑98.

WordPress sites that use the whatwouldjessedo Simple Retail Menus plugin, version 4.2.1 or earlier. The vulnerability is present in all releases up to and including 4.2.1.

The CVSS base score of 7.5 indicates considerable risk, but the EPSS score of less than 1% shows a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because the flaw manifests through an untrusted source parameter for a file include, the likely attack vector is via the plugin’s web interface or through a crafted request that supplies a path to an arbitrary local file. This inference is drawn from the description of improper filename control. Exploitation typically requires the attacker to have access to the server’s file system, but if the attacker can influence the include argument, remote code execution becomes possible.