The Simple CSV Table plugin for WordPress contains a directory traversal flaw in the href parameter of the [csv] shortcode. The lack of proper path validation allows an authenticated user with Contributor-level access or higher to read any file on the server whose path can be formulated, potentially exposing database credentials or authentication keys. The weakness is a classic path traversal attack (CWE‑22).

All users of the iworks Simple CSV Table plugin running version 1.0.1 or earlier are affected. No specific operating system or WordPress version is singled out, but any site that has installed the vulnerable plugin and has Contributor or higher roles is at risk.

The CVSS score of 6.5 classifies the vulnerability as moderately severe. The EPSS score of 2% indicates that exploitation has been observed at a low but non-zero frequency. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access; therefore attackers need to first compromise or abuse a Contributor+ account. Once authenticated, they can construct a malicious href to read arbitrary files. The attack chain is straightforward and does not rely on additional environmental conditions beyond normal plugin usage.