A malformed include/require call in the wpDataTables WordPress plugin allows a local file inclusion flaw. An attacker can supply a crafted filename that leads the plugin to read files from the server’s filesystem, potentially exposing sensitive data or including attacker‑controlled PHP code for execution. The flaw falls under CWE‑98 and could compromise confidentiality, integrity, or availability of the affected web application if exploited.

WordPress sites running the wpDataTables plugin up to version 6.5.0.1 are affected. This includes all installations using locations of the plugin accessible through the web interface.

The CVSS score of 7.5 indicates a high severity, but the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current exploitation likelihood. Likely attack vectors involve a local attacker with web access to the plugin directory, or an attacker leveraging other input channels in the plugin that allow manipulation of the include path. No public exploit code is documented at this time. The threat requires the attacker to send specific requests targeting the vulnerable include logic and is local to the web server environment.