The GPX Viewer WordPress plugin contains a Path Traversal flaw that allows an attacker to read arbitrary files on the server by supplying an input such as ".../...//". The flaw does not enable code execution or denial of service; its primary impact is the disclosure of confidential files that may exist on the host. The weakness is a classic input validation issue (CWE‑22).

Any WordPress site using the axelkeller GPX Viewer plugin up to and including version 2.2.11 is affected. The plugin is distributed as a WordPress plugin and does not include a higher, patched version in the current data set.

The CVSS score of 4.9 marks it as a moderate severity issue, while the EPSS score of less than 1% indicates a very low probability of exploitation at this time. It is not listed in the CISA KEV catalog. The most likely attack vector is a remote web request to a vulnerable plugin endpoint, where the attacker crafts a malicious path parameter; successful exploitation simply retrieves the targeted file contents.