The PhastPress plugin for WordPress is vulnerable to an unauthenticated arbitrary file read via null byte injection in all releases up to and including version 3.7. The flaw originates from a mismatch between the extension validation logic, which operates on URL‑decoded paths, and the path‑construction routine that strips content after a null byte. An attacker can craft a URL containing a double URL‑encoded null byte (%2500) followed by a permitted extension and cause the plugin to read and return any file from the webroot, including sensitive files such as wp-config.php. This exposes confidential configuration data and could enable further compromise.

The affected product is the PhastPress WordPress plugin developed by Kiboit. All releases up to and including version 3.7 of the plugin are affected. WordPress sites that have not upgraded beyond 3.7 while the plugin remains active are at risk.

The CVSS base score is 9.8, marking the flaw as critical. The EPSS score is below 1 %, indicating a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Still, the attack is straightforward: an unauthenticated visitor can send a crafted request with a double‑encoded null byte and an allowed extension to the site, triggering the plugin to read arbitrary files from the webroot. No authentication, privileged access, or complex configuration is required for exploitation.