The flaw exists in the Apptha Slider Gallery 1.0 WordPress plugin and allows unauthenticated attackers to supply a crafted imgname parameter in asgallDownload.php, enabling directory traversal and download of files outside the intended directory. This path traversal vulnerability can reveal sensitive system or configuration files, compromising confidentiality and integrity of the affected host. Because the flaw is remotely exploitable with no authentication required, any reachable WordPress site running the affected plugin is at risk.

WordPress installations that have the Apptha Slider Gallery plugin version 1.0 installed are affected. No other versions were indicated in the CNA data; site administrators should verify whether their deployment uses this vulnerable version.

The CVSS score of 8.7 indicates high severity, reflecting the low complexity of exploitation and serious impact on data confidentiality and integrity. No EPSS score is available, so the current probability of exploitation in the wild cannot be quantified, but the attack path is straightforward: a crafted HTTP request to asgallDownload.php containing ../ sequences. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented active exploitation campaigns at the time of this analysis, although the potential for abuse remains.