The WP01 plugin contains a missing capability verification and unrestricted use of the make_archive function, allowing authenticated users with Subscriber-level access to trigger arbitrary file downloads from the server. This flaw permits the attacker to read file contents that may hold sensitive data, leading to confidentiality compromise. The weakness maps to CWE-862: Permissions Error.

All installations of the WP01 – Speed, Security, SEO consultant plugin for WordPress, from all vendor releases up to and including version 2.6.2. The flaw exists in plugin files under the wp01 directory on any WordPress site that has not yet upgraded beyond that version.

The CVSS base score of 6.5 indicates medium severity. The EPSS score of less than 1% reflects a low probability that this vulnerability is actively exploited in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires a logged‑in user with at least Subscriber rights; such a user can supply a crafted request to the make_archive endpoint to download any file located on the server’s file system that the web server process can read. This attack does not appear to require additional privileges or a separate vulnerability, and therefore the risk to any compromised site is significant while the likelihood remains low under current public data.