WordPress Search with Typesense Plugin versions 2.0.8 and earlier contain a path‑traversal flaw caused by improper validation of search query strings. An attacker who can send a crafted request may obtain arbitrary files from the server, potentially enabling disclosure of sensitive information or the execution of local code if writable files are involved. The vulnerability is identified as CWE‑35.

The affected product is CodeManas Search with Typesense for WordPress. All releases up to version 2.0.8 are vulnerable; users of v2.0.8 and earlier are at risk.

With a CVSS score of 6.8 the flaw is considered moderate severity. The EPSS score of less than 1 % indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV database. Based on the description, the likely attack vector is remote via a crafted search query submitted to the plugin’s endpoint; authentication is not explicitly required, so a public user could trigger the flaw. Once triggered, the attacker can read any file accessible to the web server process.