Google Drive for WordPress version 2.2 contains a path‑traversal flaw that allows an unauthenticated attacker to read any file on the server by supplying directory traversal sequences in the file_name parameter. By sending a POST request to gdrive‑ajaxs.php with ajaxstype set to del_fl_bkp and a file_name such as ../../wp-config.php the attacker can obtain sensitive configuration information, potentially exposing database credentials and other confidential data. This flaw is derived from CWE‑22, a directory traversal weakness that compromises confidentiality.

The vulnerability affects only the Google Drive for WordPress plugin, specifically version 2.2, which is installed on WordPress sites that use this plugin to integrate Google Drive storage. No other WordPress core components are implicated.

The CVSS score of 8.7 indicates high severity, reflecting a significant risk to confidentiality when exploited. The EPSS score is not provided, so the likelihood of exploitation is unknown, but path‑traversal bugs are commonly targeted by attackers due to their simplicity. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet, but the absence of a CVE noting an exploit does not diminish the risk for affected sites.