The Gotham Block Extra Light WordPress plugin contains an authenticated arbitrary file read flaw due to the unfettered 'ghostban' shortcode. With contributor-level access or higher, an attacker can request the shortcode to include the contents of any file on the server, potentially exposing sensitive data. This issue is categorized as CWE-22 and provides direct read access to files that are normally protected by the web server configuration.

All installations of the Gotham Block Extra Light plugin with a version of 1.5.0 or earlier are affected. This includes any WordPress site that has added the plugin and granted contributor or administrator roles to users.

The vulnerability has a CVSS score of 6.5, indicating a moderate level of severity. The EPSS score is below 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. However, the exploit requires only authenticated access with contributor privileges, a fairly common role on many sites, and the attack path is straightforward: a contributor can insert or visit a page that triggers the 'ghostban' shortcode, forcing the plugin to read and return any file path specified.