The flaw is an improper control of the filename used in a PHP include/require statement. An attacker who can influence the path to a non‑existent or local file can cause the WordPress Golo Framework to load data from that location. If the attacker supplies a file that contains executable PHP code, the flaw could enable arbitrary code execution on the server. Classified as CWE‑98, the vulnerability carries a CVSS score of 7.5, indicating a serious impact on confidentiality, integrity, and availability.

The vulnerability exists in the Golo Framework WordPress plugin developed by uxper. All releases up to and including version 1.7.3 are affected. Sites that maintain these versions are at risk and should verify the installed version against the fixed baseline.

Although the EPSS score is less than 1%, it indicates that exploitation opportunities are limited. The likely attack vector involves manipulating a file path parameter or uploading a malicious file that the plugin will then include. Because the vulnerability allows inclusion of local files, an attacker can read or execute code in directories that are reachable to the PHP interpreter, potentially compromising the entire site. The risk is regarded as medium to high for environments where user input is not strictly filtered.