The simplified data collector plugin for WordPress (简数采集器) contains a flaw in its __kds_flag feature, which is used when importing featured images. An attacker who can log in with at least Administrator privileges can supply a specially crafted request that causes the plugin to read any file on the server. Read access to arbitrary files can expose configuration files, credentials, or other sensitive data, compromising confidentiality of the site and potentially the underlying server.

WordPress sites that have the 简数采集器 plugin installed in any version 2.6.3 or earlier. The vulnerability affects all installations that have enabled the __kds_flag import functionality, regardless of the WordPress version. The vendor is Zhengdon.

The flaw has a moderate CVSS base score of 4.9 and an EPSS score below 1%, indicating a low likelihood of widespread exploitation. It is not listed in the CISA KEV catalog. The attack requires authenticated access with Administrator or higher role, so the likelihood is limited to privileged users. Because the plugin’s relative path handling is unchecked, an attacker can read files outside the webroot. If the site configuration allows, this could expose secrets or private data.