The vulnerability is a path traversal flaw in the Aspose Doc Exporter WordPress plugin before version 2.0. Unsanitized input supplied to the 'file' parameter of aspose_doc_exporter_download.php is passed directly to readfile(), allowing attackers to download any file that the web server can access. The potential impact is the disclosure of sensitive files such as wp-config.php, which may contain database credentials and other confidential information, thereby compromising confidentiality and possibly integrity of the WordPress installation.

Affected are WordPress sites running the Aspose Doc Exporter plugin with a version prior to 2.0. No specific minor versions are listed; the plugin is the determining factor.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Existence of exploit evidence from Shadowserver dated 2023‑10‑23 suggests that the flaw has been observed in the wild. The likely attack vector is unauthenticated HTTP GET requests, which can be performed by external actors to retrieve arbitrary files on the target server.