The vulnerability is a path traversal flaw in the WordPress belingoGeo plugin that permits an attacker to retrieve arbitrary files from the server’s filesystem. By supplying a crafted file path, a malicious actor can download any file that the web server can access, potentially exposing configuration data, credentials, or other sensitive information. This weakness is classified as CWE‑22 and technically constitutes an Improper Limitation of a Pathname to a Restricted Directory.

All installations of the Belingo belingoGeo WordPress plugin up to and including version 1.12.0 are affected. WordPress sites running any of these versions without a newer update are at risk. The vulnerability is not linked to any additional vendors or software beyond the plugin itself.

The CVSS score of 7.5 indicates a high severity risk, while the EPSS score of less than 1% suggests that current exploitation rates are low but non‑zero. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTTP request to the plugin’s download endpoint with a path that traverses directories; no user authentication is required to construct the path (this is inferred from the description). The attacker can therefore download arbitrary files without prior authentication, leaving exposed sites highly vulnerable if the plugin remains unpatched.