The Photocart Link 1.6 plugin contains a local file inclusion flaw that permits unauthenticated attackers to read any file on the web server. By supplying a base64‑encoded file path in the ‘id’ parameter to decode.php, an attacker can retrieve sensitive files such as wp‑config.php, exposing database credentials and site configuration data. This falls under CWE‑98 – Unrestricted File Inclusion.

KaymeePhotography’s Photocart Link plugin, version 1.6, installed on WordPress sites. Any site that has not upgraded past this version is vulnerable.

The CVSS score of 6.9 indicates a moderate‑to‑high level of risk, and the vulnerability can be exploited remotely without authentication by simply issuing an HTTP request to decode.php. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation and the flaw is not listed in CISA’s KEV catalog. Attackers can use the flaw to gain credential information and potentially pivot to further compromise the host.