Apptha Mac Photo Gallery 3.0 for WordPress contains a path‑traversal flaw that lets an unauthenticated attacker request arbitrary files by manipulating the albid parameter sent to macdownload.php. By supplying directory traversal sequences, a malicious user can download sensitive files such as wp-load.php from outside the plugin directory, exposing confidential site data and potentially other files on the server. This vulnerability does not provide code execution or denial of service, but enables data theft through file disclosure.

The flaw is limited to the Mac Photo Gallery plugin version 3.0 used in WordPress installations.

With a CVSS score of 8.7 the flaw is considered high risk. No EPSS score is available, but the lack of public exploitation or KEV listing suggests the vulnerability is not actively exploited at the time of this analysis. The attack vector is remote; any user who can reach the site can craft a request to macdownload.php with a manipulated albid value, bypassing authentication and directory boundaries with no additional preconditions.