WP Vault 0.8.6.6 contains a local file inclusion flaw that allows unauthenticated users to read arbitrary files on the web server. The vulnerability is triggered by supplying a directory traversal sequence in the wpv-­image GET parameter, which the plugin does not properly escape. By exploiting this weakness, an attacker can access sensitive files such as system configuration files and credential stores; this is a classic CWE‑98 – Unescaped Input in File Inclusion.

The flaw affects the WP Vault plugin version 0.8.6.6, developed by myasui for WordPress sites, and any site running this plugin without an updated version will be vulnerable.

With a CVSS score of 6.9, the vulnerability presents a moderate severity risk. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, but it remains exploitable because no authentication is required and the plugin simply parses the GET parameter. An attacker only needs to construct a URL such as /?wpv-image=../../../../etc/passwd to read arbitrary files, indicating that, if the plugin is present and not patched, the risk is tangible.