The cab-fare-calculator WordPress plugin version 1.0.3 contains a local file inclusion flaw that is exploitable without authentication. An attacker can manipulate the controller parameter in tblight.php to supply path traversal sequences, enabling inclusion of files outside the intended controllers directory. This can allow the attacker to read sensitive files such as configuration files, credentials, or other secrets stored on the web host, potentially leading to further compromise. The vulnerability is identified as CWE-98.

WordPress sites that have the cab-fare-calculator plugin installed, specifically version 1.0.3 released by the vendor cab-fare-calculator. No other versions are listed as affected in the available data.

The CVSS score of 6.9 indicates a moderate severity, with the vulnerability being exploitable over the network by any user able to craft a URL to the plugin’s controller endpoint. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. However, because the attack does not require authentication, the risk of exploitation remains significant for sites that have not updated the plugin.