This vulnerability arises from improper validation of filenames used in PHP include or require statements within the CedCommerce Integration for Good Market plugin. It allows an attacker to perform Local File Inclusion (LFI), which can lead to arbitrary code execution or disclosure of sensitive files. The issue affects versions up to and including 1.0.6. The CVSS 3.1 vector indicates the attack requires network access, has high complexity, no privileges required, and user interaction is needed. The impact includes high confidentiality, integrity, and availability consequences.

Successful exploitation can lead to local file inclusion, which may allow attackers to execute arbitrary code, disclose sensitive information, or disrupt service availability on affected installations of CedCommerce Integration for Good Market up to version 1.0.6. The CVSS score of 7.5 reflects a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin and avoid exposing it to untrusted users. Monitor vendor channels for updates and apply patches promptly once available.