The Category Icon plugin for WordPress contains a path traversal flaw (CWE‑22). An attacker can craft a request that causes the plugin to read and serve files outside its intended directory, allowing the download of arbitrary files on the server. This may expose sensitive data such as configuration files, database credentials or code, compromising confidentiality.

Any WordPress installation that has the Category Icon plugin from pixelgrade version 1.0.1 or earlier is affected. The vulnerability applies to all sites where this plugin is active, regardless of other security controls.

The vulnerability carries a CVSS score of 4.9, indicating a moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Exploitation likely requires only a standard web request to the plugin’s file retrieval functionality, but the CVE description does not explicitly state whether authentication or special privileges are required; therefore, the need for such credentials remains uncertain.