The vulnerability in Mayosis Core allows an unauthenticated user to retrieve any file stored on the web server through the remote_dl.php endpoint. Because the plugin does not validate the requested file path, attackers can direct requests to system files, configuration files, or other sensitive data, potentially exposing credentials or secrets. This weakness, characterized as a CWE‑22 path traversal flaw, directly compromises confidentiality by allowing eavesdropping on sensitive server contents.

The affected vendor is TeconceTheme with the Mayosis Core WordPress plugin version 5.4.1 and earlier. No additional products or versions are listed in the vendor’s enumeration, so only installations of Mayosis Core at or below 5.4.1 are susceptible.

The CVSS score of 7.5 places this issue in the high severity range. An EPSS score of 1% indicates that a very low, but not negligible, proportion of vulnerability scanners or exploit tools are likely to target this weakness. The issue is not currently listed in the CISA KEV catalog. Exploitation requires no special privileges or authenticated access; any internet‑connected user can craft a request to remote_dl.php and obtain the contents of arbitrary files, assuming no server‑side restrictions are in place. This local filesystem read can lead to disclosure of critical data supporting further attacks such as credential stuffing or application compromise.