The vulnerability arises from improper control of the filename supplied to an include/require statement in the SW Core plugin. Because the input is not properly validated, an attacker can supply a path that results in the inclusion of arbitrary local files. This flaw is classified as CWE‑98, Local File Inclusion. If successfully exploited, the attacker could read sensitive configuration files, credentials, or potentially execute arbitrary PHP code, leading to compromise of the affected WordPress site.

Magentech's SW Core plugin for WordPress, versions up through 1.7.18, is affected. The vulnerability is present in all releases from the earliest available version through 1.7.18. No specific host or environment constraints were listed, so any WordPress installation running an affected version of the plugin is at risk.

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA's KEV catalog, so there is no evidence of known exploitation in the wild. Based on the description, it is inferred that the attack vector involves local file inclusion via the plugin's web interface and that some form of user access (unauthenticated or authenticated) is required to trigger the include logic. While the probability of exploitation is not quantified, the high CVSS and lack of mitigations suggest that administrators should treat this as a high risk to confidentiality, integrity, and availability.