John Weissberg’s Print Science Designer plugin contains a path‑traversal flaw that lets an attacker request and download arbitrary files from the server’s filesystem. By supplying a specially crafted filename parameter, the plugin’s download routine resolves and reads files outside the intended directory, potentially revealing sensitive configuration files, credentials, or other confidential data.

The vulnerability affects all versions of Print Science Designer from the initial release through version 1.3.155, inclusive. WordPress sites that have installed any of these plugin versions are susceptible.

With a CVSS score of 7.5 the flaw is considered high severity, yet the EPSS score indicates a very low probability of exploitation, and it is not currently listed in CISA’s KEV catalog. The attack vector is remote via the web – an attacker only needs to construct a URL to the plugin’s download endpoint and supply a path‑traversal string. Successful exploitation grants read access to files that may contain critical information.