WordPress Dharma Booking plugin 2.28.3 and earlier allows an unauthenticated attacker to include arbitrary files through the gateway parameter in proccess.php. By supplying directory traversal sequences or null byte injections, the attacker can read sensitive files such as configuration files or system files, compromising confidentiality of source code and potentially exposing credentials or system information. The weakness is an instance of insecure file inclusion (CWE-98).

The vulnerability affects the WordPress plugin Dharma Booking by jamie, version 2.28.3 and any earlier releases. No other vendors or versions are specifically listed.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a simple HTTP request to proccess.php with a crafted gateway parameter, requiring no special privileges or authentication. Although the vulnerability does not provide direct code execution, reading sensitive files can lead to further exploitation such as credential theft or system compromise.