The vulnerability is a Path Traversal flaw (CWE‑22) in LikeCoin’s Web3Press plugin versions 3.2.0 and earlier. It permits an unauthenticated attacker to manipulate the plugin’s file‑path handling and read arbitrary files on the server, potentially exposing sensitive configuration, credentials or code. The flaw does not provide remote code execution but can reveal confidential data or aid further attacks.

This issue affects the LikeCoin Web3Press product, released by the LikeCoin vendor. All WordPress installations that have the plugin installed in any version up to and including 3.2.0 are at risk. No specific WordPress core version is mentioned, so the vulnerability applies wherever the plugin is present.

The CVSS score of 6.5 indicates a moderate severity. The EPSS analysis shows a very low exploitation probability (<1%). The vulnerability has not been included in the CISA KEV list, implying it is not known to be actively exploited in the wild yet. An attacker could exploit the path traversal by sending a request containing directory traversal sequences to the plugin’s file‑reading endpoint, provided the server allows such requests. As the vulnerability is unauthenticated, any external user could trigger it, especially if the plugin’s endpoint is exposed to the public internet.