The Simple Download Counter WordPress plugin contains a path‑traversal flaw in the function simple_download_counter_parse_path. An attacker who has Administrator or higher privileges can supply a crafted filename and cause the plugin to read files outside the intended directory. This allows the reading of sensitive files such as wp‑config.php, potentially exposing database credentials or other confidential data. The weakness, classified as CWE‑22, leads to an arbitrary file read rather than code execution.

Affected products are the Simple Download Counter plugin for WordPress, version 2.2.2 and all earlier releases. The vendor, specialk, has not released a fixed version yet, but has disabled remote file downloads on multisite installations. No other WordPress plugins or software are listed as impacted.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the issue requires authenticated access with Administrator privileges, it is most likely to be abused in trusted sites that have compromised admin credentials or by insider threats. The path traversal can be triggered remotely via the plugin’s admin interface, so any site that still runs the unpatched plugin is potentially vulnerable.