The flaw is an improper control of the filename used in a PHP include/require statement within the WpBookingly plugin, identified as CWE-98. This issue allows a local file inclusion in the plugin, which can be triggered to read arbitrary files from the server. The violation could expose configuration or credential files, leading to confidentiality compromise.

The vulnerability is present in the magepeopleteam WpBookingly service‑booking‑manager plugin for all versions from the initial release (n/a) through version 1.2.9. Any WordPress installation that has a vulnerable version installed is at risk.

The base CVSS score is 7.5, representing high severity. The EPSS score is below 1%, indicating low likelihood of exploitation at present. The vulnerability is not included in the CISA KEV catalog. Inferred that the attacker must be able to influence the file path parameter used by the plugin, typically through a URL or form input; this makes the attack vector likely application‑layer local file inclusion. The primary impact is the potential disclosure of sensitive files and can serve as a foothold for further compromise if additional weaknesses exist.