Javo Spot WordPress theme versions older than 3.0.0 allow an attacker to send a crafted GET request to the WordPress AJAX handler and control the fn query parameter. The theme’s jvfrm_spot_get_json action unsafely concatenates this value with a server file path, enabling path traversal. As a result, an unauthenticated user can read arbitrary files, including wp-config.php, and obtain database credentials and salts. The vulnerability exposes sensitive data and could facilitate further compromise of the site.

Any WordPress installation using Javo Themes’ Javo Spot theme before version 3.0.0 is vulnerable. The issue is present across all builds shipped before the 3.0.0 release; no other WordPress themes or core files are affected.

The CVSS v3.1 score of 8.7 indicates high severity, and the exploitation path requires only a simple HTTP GET request with no authentication or special privileges. The EPSS score is not listed, but the lack of a KEV record does not negate the risk. Because the attacker can read any file on the server, the impact includes disclosure of configuration secrets, credentials, and potentially other sensitive data. It is probable that sites using older Javo Spot themes will be targeted.