The Feeds for YouTube Pro plugin contains a path‑traversal flaw that allows an unauthenticated attacker to read any file on the server by invoking the unprotected sby_check_wp_submit AJAX action. Insufficient sanitization of user‑supplied data and its direct use in a file operation enables this read. The weakness is classified as CWE‑22 and the CVSS score of 5.9 indicates moderate severity.

All installations of the Pro version of Feeds for YouTube—issued by Awesome Motive—running WordPress and version 2.6.0 or earlier are vulnerable. Versions newer than 2.6.0 are presumed patched, while non‑Pro releases are not impacted.

The vulnerability requires no credentials and can be triggered with a simple HTTP request to the plugin’s AJAX endpoint, making exploitation straightforward. The EPSS score of <1% suggests a low probability of widespread deployment, and the issue is not tracked in the CISA KEV catalog. If the vulnerable settings remain enabled, an attacker could read arbitrary files, potentially exposing configuration data, credentials or other secrets.