The vulnerability is a path traversal flaw (CWE-22) that allows an attacker to request arbitrary files from the server through the Houzez Property Feed plugin. By crafting a specially formatted request, the attacker can read sensitive files such as configuration files or credentials, compromising confidentiality and potentially integrity of the system. The impact is limited to file download, but can expose information that may enable further attacks.

Property Hive Houzez Property Feed, a WordPress plugin, is affected for all releases up to and including version 2.5.4. No newer versions are listed as affected in the current data.

The CVSS score is 7.5, indicating high severity, while the EPSS score is below 1%, suggesting that exploitation is not common. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, using the plugin’s file retrieval endpoint, and it requires the attacker to be able to send HTTP requests to the vulnerable server.