The vulnerability is an improper control of filenames used in include/require statements within the EduBlink Core WordPress plugin. This flaw permits local file inclusion, which can lead to the execution of arbitrary PHP code or disclosure of sensitive files on the web server. The weakness is identified as a Local File Inclusion flaw, a subtype of Remote File Inclusion, and is catalogued as CWE-98. The impact includes potential compromise of confidentiality, integrity, or availability of the affected website, depending on the files accessed or exploited.

This issue affects the EduBlink Core plugin developed by DevsBlink. Versions from the initial release through version 2.0.7 are vulnerable. Systems running any version of WordPress with this plugin installed are at risk until the plugin is updated beyond 2.0.7.

The CVSS score of 7.5 indicates a high severity vulnerability, and the EPSS score of less than 1% suggests a low but non-zero probability of exploitation in the wild at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web-based request that can trigger the inclusion of a local file, which is inferred from the nature of the flaw. An attacker could exploit this vector to execute code or read sensitive files, provided they have sufficient permissions on the server or can influence the filename parameter in the plugin's code.