Description
This script is possibly vulnerable to file inclusion attacks.
It seems that this script includes a file which name is determined using user-supplied data. This data is not properly validated before being passed to the include function.
Remediation
Edit the source code to ensure that input is properly validated. Where is possible, it is recommended to make a list of accepted filenames and restrict the input to that list.
For PHP, the option allow_url_fopen would normally allow a programmer to open, include or otherwise use a remote file using a URL rather than a local file path. It is recommended to disable this option from php.ini.
References
Related Vulnerabilities
WordPress Plugin Adsense Extreme 'adsensextreme[lang]' Parameter Remote File Include (1.0.3)
ownCloud Improper Input Validation Vulnerability (CVE-2020-28645)
WordPress Plugin Dean's FCKEditor with pwwang's code Arbitrary File Upload (1.0.0)
WordPress Plugin Sina Extension for Elementor Local File Inclusion (2.2.0)
WordPress Plugin Simple Ads Manager Local File Inclusion (2.10.0.130)