The Golo Framework WordPress plugin has an improper control of the filename used in a PHP include/require statement. Because the plugin accepts a file path without proper validation, an attacker can influence the name of a local file that the plugin includes. The flaw is classified as CWE‑98 and carries a CVSS score of 7.5, indicating a high potential impact on confidentiality and integrity.

The vulnerability affects the Golo Framework WordPress plugin developed by uxper. All releases up to and including version 1.7.3 are vulnerable; sites using any of these versions are at risk.

The EPSS score is less than 1 %, suggesting that exploitation opportunities are limited. The likely attack vector involves manipulating a file path parameter or uploading a local file that the plugin will then include. Because the plugin can include local PHP files, an attacker who can influence which file is included could potentially read sensitive data or execute code located on the server, depending on the server’s configuration and file permissions.