An improper limitation of pathname to a restricted directory flaw in the Infility Global WordPress plugin permits an attacker to craft a request that includes a traversal sequence, enabling the download of arbitrary files from the server. This path traversal vulnerability can expose sensitive files such as configuration data, passwords, or other confidential information. The weakness is classified as CWE-22.

Infility: Infility Global plugin is affected. The vulnerability applies to all versions from the plugin’s earliest release up through 2.15.06. No versions beyond 2.15.06 have been confirmed to contain the flaw.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is likely remote via a web request to the plugin’s endpoint that accepts a path parameter; it is inferred that authentication is not required, though the origin description does not explicitly state this. Exploitation would involve manipulating the path to read files outside the intended directory.