Cherry Plugin for WordPress versions earlier than 1.2.7 contains a path traversal vulnerability that allows an attacker to request arbitrary files from the server. By sending a crafted GET request to /admin/import-export/download-content.php with a value such as ../../../../wp-config.php for the file parameter, the script passes the unsanitized path to readfile(), resulting in the contents of the file being returned. The vulnerability can expose sensitive data, including database credentials and other configuration files, leading to confidentiality compromise and potential database compromise.

The affected product is Cherry Plugin developed by Cherry Team. All installations of Cherry Plugin earlier than version 1.2.7 are vulnerable. The attack surface is the download-content.php script located under the admin/import-export path in WordPress deployments that use that plugin.

The CVSS score of 8.7 indicates a high severity impact. Although an EPSS score is not available, exploitation evidence was reported in October 2023, suggesting that attackers are actively using this weakness. The vulnerability does not require authentication and can be triggered via a standard HTTP GET request, making it highly likely to be exploited if an attacker discovers the exposed endpoint. This vulnerability is not listed in CISA KEV at present, but the combination of a high CVSS score and evidence of exploitation underscores the need for prompt remediation.