The vulnerability is an improper limitation of a pathname to a restricted directory, allowing an attacker to download arbitrary files from the server. This path traversal flaw can lead to confidential data disclosure if the attacker can select sensitive files. The weakness corresponds to CWE‑22, a typical directory traversal vulnerability that bypasses intended file access restrictions.

The vulnerability affects the WordPress Nomupay Payment Processing Gateway plugin provided by totalprocessing, version 7.1.7 and earlier. The plugin is used in WordPress environments that handle payment processing. No later versions are listed as affected.

The CVSS base score of 4.9 indicates moderate severity. The EPSS score of less than 1% suggests that the probability of exploitation in the wild is low. The vulnerability is not listed in CISA’s KEV catalog, further indicating low threat visibility. Based on the description, it is inferred that the attack vector involves manipulating a file download endpoint exposed by the plugin to request arbitrary server files. An attacker would need the ability to trigger this endpoint, potentially via a public URL or administrative action, and the input must bypass validation that restricts the file path.