The vulnerability exists in the Auto Amazon Links – Amazon Associates Affiliate Plugin for WordPress. Versions up to and including 5.4.3 allow unauthenticated attackers to read arbitrary files on the server via the /wp-json/wp/v2/aal_ajax_unit_loading REST API endpoint. Because the plugin lacks proper input validation, the attacker can specify a file path and retrieve its contents, exposing sensitive data. The flaw aligns with CWE‑73 Path Traversal.

Affected systems are installations of the miunosoft Auto Amazon Links – Amazon Associates Affiliate Plugin where the version is 5.4.3 or earlier. The plugin is commonly used on WordPress sites that rely on Amazon affiliate links. No other vendors or product families are reported to be impacted.

The CVSS score of 7.5 indicates moderate to high severity, while the EPSS score being less than 1% suggests a low probability of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw from any network location that can reach the site's REST API, and no authentication is required, making the attack straightforward for anyone with access to the internet. Consequently, sites that host the plugin are at risk of leaking confidential files or configuration data.