This vulnerability allows a path traversal flaw that leads to Absolute Path Traversal in the Docxpresso WordPress plugin. An attacker can obtain files located outside the intended download directory, potentially exposing sensitive configuration data, user uploads, or other confidential information. The weakness is classified as CWE-22, indicating improper pathname restriction.

The affected product is the Docxpresso WordPress plugin version 2.6 and earlier. All releases from the initial version up to 2.6 are vulnerable; upgrading to a later version is required to remediate.

The CVSS score of 5.9 marks this as a medium‑severity issue, while the EPSS score of less than 1% suggests a low probability of exploitation at present, and it is not listed in the CISA KEV catalog. The likely attack vector involves a crafted HTTP request to the plugin’s file‑download endpoint that does not enforce proper path validation, allowing an attacker to request any file on the server’s filesystem.