An unauthenticated attacker can supply arbitrary file paths through the open GET parameter in dispatcher.php, enabling the plugin to include and read any file accessible to the web server. This flaw stems from insufficient input validation, allowing a local file read that can expose configuration files, credentials, and other sensitive data, thereby compromising confidentiality.

The vulnerability resides in WordPress plugin amministrazione-aperta version 3.7.3. WordPress sites that have installed this specific plugin version are affected; newer releases of the plugin are not known to contain the flaw.

The CVSS score of 6.9 signals a moderate severity. The EPSS score is unavailable, but the vulnerability is publicly documented and not listed in CISA’s KEV catalog. An attacker only needs to construct a URL with the open parameter pointing to a desired file, can do so without authentication, and read the targeted file, thus exposing sensitive data but not achieving code execution or broader system compromise.