This vulnerability allows an unauthenticated or potentially authenticated user to obtain the full file path of sensitive system files via the Bogdan Bendziukov Squeeze WordPress plugin. The exposed information can aid an attacker in enumerating directory structures and identifying configuration files that may contain further exploitable details. The weakness aligns with CWE-497, which describes excessive or out‑of‑range access to system data.

The affected product is Bogdan Bendziukov’s Squeeze WordPress plugin, versions from the first release through version 1.6.

With a CVSS score of 2.7 the severity is low, and the EPSS score indicates a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, suggesting no known widespread exploitation. The likely attack vector is via the WordPress administrative interface where the plugin resides, requiring at least read access to the plugin’s configuration files. Abuse of this path disclosure can assist attackers in planning subsequent attacks but does not directly compromise the system itself.