A Path Traversal flaw exists in the WHMPress WordPress plugin that allows attackers to influence file path parameters and read arbitrary files on the web server. This local file inclusion can expose sensitive configuration files or credentials, potentially enabling further compromise. The vulnerability is identified as CWE-35.

The affected product is the WHMPress plugin. Versions from 6.2 through the revision-9 release are impacted. Any WordPress site running these plugin versions is susceptible.

The CVSS score of 8.1 indicates a high severity, yet the EPSS score is less than 1% and the issue is not listed in the CISA KEV database, suggesting low current exploitation probability. Attackers could likely trigger the flaw by crafting a request that includes traversal sequences such as "../../" in the plugin’s file parameter, assuming the plugin does not otherwise sanitize path inputs. Successful exploitation would grant read access to local files, potentially leading to theft of credentials or further exploitation of the webserver.