Improper limitation of a pathname allows an attacker to traverse the directory structure and download any file from the server. The primary impact is that an unauthenticated user can obtain confidential information, leading to potential data leakage or further exploitation. The weakness corresponds to CWE-22, Path Traversal.

tstafford include-file plugin versions from n/a up to and including 1. The vulnerability affects all installed versions of the include-file plugin up to version 1, inclusive. No other products or versions are impacted.

With a CVSS score of 6.5, the vulnerability is considered moderate severity. The EPSS score is less than 1%, indicating a very low expected exploitation rate, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote via the WordPress web interface, as the flaw was identified in a plugin that handles file download requests. Because the plugin does not properly sanitize path inputs, an attacker can request arbitrary files, achieving read‑only data disclosure. There are currently no publicly known exploits, but the potential for abuse remains, so monitoring and remediation are advised.