The Code Explorer WordPress plugin contains a path‑traversal flaw in the 'file' parameter that allows any authenticated user with Administrator or higher privileges to read the contents of arbitrary files on the server. This can expose sensitive data stored on the website files or system directories. The weakness is a classic path‑traversal error (CWE‑22) and is confined to authorized internal users, not to unauthenticated visitors.

qriouslad Code Explorer versions 1.0 to 1.4.6, deployed on WordPress sites.

The CVSS score of 4.9 classifies this vulnerability as moderate in severity, and the EPSS score of less than 1 % indicates that exploitation attempts are expected to be very rare. Since the flaw requires authentication as an administrator, it is unlikely to be exploited by attackers who have not already compromised accounts. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited.