The Omnipress WordPress plugin contains an improper control of filename in its include/require logic, allowing an attacker to cause the plugin to include arbitrary files from the local filesystem. This flaw may enable the execution of injected PHP code or the disclosure of sensitive files such as configuration or user data. The weakness is a classic Local File Inclusion vulnerability mapped to CWE-98.

The affected product is the Omnipress plugin developed by the Omnipressteam team. Versions from the earliest release up to and including 1.6.7 are impacted.

The vulnerability carries a CVSS base score of 7.6, indicating a moderate to high potential impact. The EPSS score is less than 1 %, suggesting a low probability of exploitation at the current time, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the attack vector requires an attacker to send a crafted request to the plugin’s vulnerable endpoint, likely targeting authenticated admin users or users able to access certain plugin pages. If an attacker can embed a PHP file that is subsequently included, remote code execution could be achieved. While the low EPSS score mitigates immediate threat, the potential impact warrants prompt action.