Seofy Core, a WordPress plugin from WebGeniusLab, contains a path traversal flaw that permits Local File Inclusion via PHP. The vulnerability allows an unauthenticated user to read arbitrary files on the server, potentially exposing sensitive data, configuration files, or executing code. This compromises confidentiality and integrity and, if exploit payloads are successfully included, could lead to remote code execution and full system takeover.

WebGeniusLab’s Seofy Core WordPress plugin. Version 1.6.8 and earlier are affected. Any WordPress site that has installed Seofy Core at or below this version and has not applied the latest update is impacted.

The CVSS score of 8.1 classifies the flaw as high severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild at this time, and the vulnerability is not listed in the CISA KEV catalog. Based on the path traversal description, the likely attack vector involves crafting a request to the plugin’s endpoint to traverse directories and fetch arbitrary files via PHP. An attacker would need no special privileges beyond the web interface, making the vulnerability publicly exploitable.