The vulnerability is a Path Traversal flaw (CWE‑22) that allows an attacker to construct requests that bypass the intended restriction on file paths. By sending a crafted request to the plugin’s download endpoint, an attacker can fetch any readable file on the server that the web process can access. The result is the delivery of arbitrary files to the client, leading to potential exposure of sensitive data, configuration files, or application code.

LambertGroup’s HTML5 Radio Player – WPBakery Page Builder Addon is affected in all releases up to and including version 2.5. The plugin is used within WordPress sites where it is typically installed by site administrators. No specific OS or server platform limits are identified, so the risk applies to any WordPress deployment that has the vulnerable plugin installed.

The CVSS score of 7.5 indicates a high severity with an exploit likely accessible over the network. The EPSS score of less than 1% suggests the probability of exploitation at this time is low, and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers would need to direct a request to the plugin endpoint, but no authentication is required, making the attack vector remote and straightforward. Successful exploitation would give the attacker read access to any files located within the web server’s accessible directory tree.