The TinyMCE Thumbnail Gallery WordPress plugin contains a path traversal flaw that allows an attacker to retrieve arbitrary files from the web server through the download-image.php endpoint. By including traversal sequences in the href parameter, an unauthenticated user can read critical files such as wp-config.php and other system files. The vulnerability is identified as CWE‑22. The consequences are significant, as an attacker can obtain database credentials, configuration secrets, and potentially sensitive data, facilitating further compromise or data exfiltration.

The affected product is TinyMCE Thumbnail Gallery for WordPress, developed by James Charlesworth. All releases of the plugin prior to version 1.1.0 are vulnerable. The path traversal issue appears in the download-image.php script supplied by the plugin. Consequently, sites running any vulnerable version of the plugin are exposed.

The CVSS base score is 8.7, indicating high severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by crafting a simple GET request to /download-image.php with a carefully crafted href value; no authentication or additional privileges are required. Because the exploitation is straightforward and the vulnerability was observed in the wild, the overall risk remains high. Administrators should act to eliminate the exposure.