The vulnerability is a directory traversal flaw triggered via the layout parameter in the Widget for Google Reviews plugin. An authenticated user with at least Subscriber level can supply a crafted layout value that points to local files on the server. If the referenced file is a PHP script, the plugin will include and execute it, effectively allowing the attacker to run arbitrary PHP code. This bypasses normal access controls and can expose or modify sensitive data.

All installations of the Widget for Google Reviews plugin for WordPress with version 1.0.15 or earlier. The affected code resides in the techlabpro1 Widget for Google Reviews package and applies to any WordPress site that has the plugin activated.

The CVSS score of 8.8 signifies a high severity for this locality-based vulnerability. However, the EPSS score of less than 1% indicates a very low likelihood that the flaw is being targeted in the wild. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is user‑authenticated, requiring the attacker to possess at least Subscriber-level access. An attacker would typically first upload or otherwise place a PHP file in a directory reachable by the plugin and then craft a layout parameter that traverses to that file. Once included, arbitrary code execution can be achieved. Given the need for authenticated access, the potential impact is limited to compromised accounts rather than fully unauthenticated scans.