The Yoco Payments WordPress plugin contains a path traversal flaw in the handling of the file parameter. This weakness allows an attacker to read any file on the server, potentially exposing sensitive data such as configuration files, credentials, or user information. The exploit does not require authentication and can be triggered simply by supplying a crafted file name.

All releases of Yoco Payments up to and including 3.9.0 are affected. The plugin is distributed through WordPress and commonly installed on sites that process payments. The vulnerability applies to any WordPress environment where the Yoco Payments plugin is active and has not been updated to a non‑vulnerable version.

The CVSS score of 7.5 indicates a high risk level. The EPSS score of 49% indicates that exploitation of this vulnerability is likely to occur, and it is not listed in CISA's KEV catalog. Nevertheless, because the component can be accessed by unauthenticated users and the flaw provides direct file system exposure, it is likely to be used opportunistically. A successful exploitation would grant read access to arbitrary files, undermining confidentiality and potentially enabling further attacks.