The vulnerability is a path traversal flaw that allows an attacker to access files outside the intended directory through a malformed URL pattern. An adversary could read sensitive files, such as configuration files or database dumps, compromising confidentiality. This flaw does not directly expose execution privileges, but the stolen data could lead to further attacks.

The flaw affects the AA‑Team Pro Bulk Watermark Plugin for WordPress versions from the initial release through 2.0. No specific patch level is listed for earlier versions; any installation of the plugin at or below 2.0 is impacted.

The CVSS score of 6.5 indicates moderate risk, while the EPSS of less than 1% suggests low exploitation probability, and the flaw is not currently listed in the CISA KEV catalog. Attackers likely exploit the weakness via unauthenticated web requests that trigger the plugin’s file handling code, and the traversal can be achieved without additional privileges.