The Fonto WordPress plugin contains a path‑traversal flaw (CWE‑22) that permits an attacker to request arbitrary files from the server through the plugin’s download endpoint. The flaw allows the download of any file readable by the web server process, which can expose sensitive data such as configuration files or credentials. Based on the described capability of downloading arbitrary files, it is inferred that an attacker could read files that contain credential or proprietary information, but the CVE itself does not explicitly state the specific data exposed.

The issue exists in the WordPress plugin Fonto, developed by vlad.olaru, and affects all releases up to and including version 1.2.2. Any WordPress site running a vulnerable version of this plugin is potentially exposed.

The CVSS score of 4.9 categorises the vulnerability as moderate. The EPSS score of less than 1 % indicates a very low current exploitation probability, and the flaw is not listed in the CISA KEV catalog, suggesting no confirmed public exploits. Attackers can exploit the plugin by sending a crafted request to its download endpoint without authentication, although this is inferred from the functionality described and not explicitly stated in the CVE. The impact is limited to files readable by the web server process, yet the exposure of critical data remains a real threat.