The ShopMagic email automation plugin for WordPress is vulnerable to a path traversal based local file inclusion flaw (CWE-98) in all releases through version 4.9.0. By supplying a specially crafted value for the billing_address.first_name field, an unauthenticated user can cause the plugin to include and execute arbitrary .php files stored on the server. This flaw enables arbitrary execution of PHP code, bypassing normal access controls and potentially exposing sensitive data. The vulnerability is triggered when the plugin processes the {{customer.first_name}} placeholder, which is used by the default New Order email with social media profile links recipe.

Any WordPress site running ShopMagic up to and including 4.9.0 is affected when the placeholder‑processing recipe is enabled. The default configuration of the plugin, which allows guest checkout and uses the exposed recipe, makes the attack possible on any site that has not upgraded to 4.9.1 or later. The flaw exists regardless of other active plugins or WordPress settings, as long as the vulnerable recipe is active.

The CVSS base score of 8.1 indicates high severity, while the EPSS score of 1% reflects a low but non‑zero chance of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw through an unauthenticated web request that supplies a crafted billing_address.first_name value during a guest checkout, allowing arbitrary PHP file inclusion. No authentication is required; the only prerequisites are that the vulnerable recipe is active and a PHP file is present on the server. The attack vector is purely web‑based.