The Flashcard plugin for WordPress is vulnerable to a path traversal flaw that is exploitable through the 'source' attribute of its shortcode. When an authenticated user with contributor or higher privileges supplies a crafted value containing directory traversal sequences, the plugin interprets it as a file path and returns the contents of that file to the browser. This allows the attacker to read any readable file on the server, potentially exposing database credentials, configuration files, or other sensitive information. The weakness is a classic path traversal issue (CWE‑22).

All installations of the Flashcard plugin for WordPress with a version number 0.9 or lower are vulnerable. No specific third‑party patches or version numbers that remove the flaw are listed in the available CNA data.

The vulnerability carries a CVSS score of 6.5, indicating a moderate impact. EPSS is reported to be less than 1%, implying a low probability of exploitation in the wild. It is not listed in CISA’s KEV catalog. The likely attack vector requires authentication; an attacker must be granted at least contributor access to the site and then can inject a malicious value into the shortcode. Once exploited, the attacker can read arbitrary files, which may compromise confidentiality and potentially integrity if the attacker can modify the view or metrics derived from those files.