The Apptha Slider Gallery plugin for WordPress contains a path traversal flaw that allows an attacker to read arbitrary files from the server. This weakness enables the disclosure of sensitive data such as configuration files, credentials, or other confidential information present on the affected system. Based on the description, it is inferred that an unauthenticated attacker can trigger the exploit purely through crafted web requests.

The vulnerability impacts the Apptha Slider Gallery plugin in all versions up to and including 2.5. The plugin is distributed by Apptha Plugins and integrated into WordPress sites that have installed it.

The CVSS score of 7.5 indicates a high severity impact, while the EPSS score of less than 1% suggests a low probability of exploitation under current conditions. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that attackers are likely to exploit the flaw through the plugin’s publicly accessible file retrieval interface, by sending a specially crafted request that manipulates the path parameter to traverse directories and access files beyond the intended plugin directory.