The BFG Tools – Extension Zipper plugin for WordPress contains an insufficient input validation issue in the ‘first_file’ parameter of the zip() function, creating a path traversal flaw. This flaw allows an authenticated attacker with Administrator privileges or higher to read the contents of arbitrary files and directories outside the intended /wp-content/plugins/ directory, potentially exposing sensitive data such as wp-config.php. The weakness is a classic example of CWE-22 (Path Traversal).

Any WordPress site that has the BFG Tools – Extension Zipper plugin installed at version 1.0.7 or earlier is impacted. The vulnerability applies to all versions up to and including 1.0.7.

The CVSS score of 4.9 indicates a moderate impact, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exfiltration of sensitive files is possible only for users who possess Administrator level or higher access, and requires the attacker to trigger the zip() function with a crafted first_file parameter. The exploitation path therefore demands a logged‑in privileged user and the ability to submit a request to the plugin, so the attack surface is limited to sites with exposed administrative interfaces.