The vulnerability in the Gutenberg Thim Blocks plugin allows an authenticated user with Contributor or higher privileges to read the contents of any file on the server by supplying an arbitrary file path through the 'iconSVG' parameter. This lack of proper path validation enables disclosure of sensitive files, such as wp‑config.php, which may contain database credentials and other confidential data. The impact is primarily a confidentiality breach, potentially exposing configuration secrets and other information that could be leveraged for further attacks on the WordPress instance.

Vendor Thimpress offers the Thim Blocks plugin for the WordPress Block Editor. All releases up to and including version 1.0.1 are affected. Users running the plugin at any of these versions are vulnerable until the issue is addressed in a later release.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a legitimate Contributor‑level account and occurs through server‑side rendering of the icon block. Once authenticated, an attacker can supply a crafted path to read arbitrary files, which could facilitate further reconnaissance or credential theft if not mitigated. Given the moderate severity and the fact that attackers must have existing site access, the risk remains significant but manageable with timely patching.