Improper control of filenames in the Jetpack CRM plugin allows an attacker to include arbitrary files via PHP's include/require statements, enabling local file inclusion. This flaw permits reading sensitive files on the server and potentially executing code, compromising confidentiality and integrity, as described by CWE‑98.

The vulnerability affects the Automattic Jetpack CRM WordPress plugin for all releases up to and including version 6.7.0. Any site running a Jetpack CRM plugin on or before this version is impacted.

The CVSS score of 7.5 indicates a medium‑to‑high severity risk, while the EPSS score of less than 1% suggests a low probability of exploitation at the moment. The flaw is not listed in the KEV catalog. Attackers can trigger the inclusion by manipulating input parameters that the plugin uses to build file paths; this is inferred from the description of the filename handling in the plugin. The risk becomes higher if the plugin is exposed to the public internet or contains privileged administrative functions, but overall the likelihood remains low with the current exploitation metrics.