This vulnerability in Roxnor FundEngine's wp-fundraising-donation component arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. It affects all versions up to and including 1.7.4. The issue allows an attacker with low privileges and no user interaction to potentially execute arbitrary code remotely or access sensitive files, impacting confidentiality, integrity, and availability. The CVSS score of 7.5 reflects the high severity of this vulnerability. No official patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation can lead to remote code execution or unauthorized access to sensitive files on the affected system, compromising confidentiality, integrity, and availability. The attacker requires low privileges and no user interaction, but the attack complexity is high. This could result in significant damage to the affected environment if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should monitor for updates from Roxnor and apply any official patches once released. Until then, restrict access to the affected application and consider additional controls to limit exposure.