Publitio, a WordPress plugin, contains a Path Traversal vulnerability that allows arbitrary file reads on affected sites. An attacker can craft a request that includes directory traversal sequences to read files outside the intended directory, potentially exposing sensitive configuration, credential, or code files. This flaw is identified as CWE‑22 and can lead to confidentiality breaches without granting code execution privileges.

The vulnerability applies to all WordPress installations that use Publitio plugin version 2.2.0 or earlier. Any user, regardless of role, who has access to the plugin’s exposed endpoints is susceptible unless the vulnerable functionality has been disabled.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker would likely exploit this flaw remotely by sending a specially crafted request to the plugin’s file read endpoint, leveraging the lack of proper path restriction. While unlikely, the risk is tangible for unpatched sites, making timely patching a prudent course of action.