The Totalprocessing Card Payments plugin for WooCommerce suffers from a path traversal flaw (CWE-22) that allows attackers to download arbitrary files from the server’s file system. The vulnerability arises because the plugin does not properly limit pathname resolution to a designated directory, enabling the retrieval of any file location beyond its intended scope.

The vulnerable product is the WordPress Totalprocessing Card Payments plugin, also known as Nomupay Payment Processing Gateway, for all versions from the initial release through version 7.1.5. WordPress sites hosting this plugin are thus affected.

The CVSS score of 6.5 reflects moderate risk, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be a remote web request, where an attacker crafts a URL containing traversal sequences that cause the plugin to return a requested file. Successful exploitation would grant read access to arbitrary server files, thereby compromising confidentiality. No elevated local privileges are required if the attacker can reach the vulnerable site.