The cab‑fare‑calculator WordPress plugin version 1.0.3 contains a local file inclusion flaw that can be exploited without authentication. By manipulating the controller GET parameter in tblight.php, an attacker can inject path traversal sequences that cause the plugin to include files outside of its intended controllers directory, allowing arbitrary file reads. This flaw corresponds to CWE‑98 and can expose configuration files, credentials, or other sensitive data stored on the web host, potentially leading to further compromise.

WordPress sites that have the cab‑fare‑calculator plugin installed, specifically version 1.0.3 released by the vendor cab‑fare‑calculator. No other versions are listed as affected in the available data.

The CVSS score of 6.9 indicates a moderate severity, with the vulnerability being exploitable over the network by any user able to craft a URL to the plugin’s controller endpoint. The EPSS score of <1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. However, because the attack does not require authentication, the risk of exploitation remains significant for sites that have not updated the plugin.