The vulnerability is a Path Traversal flaw that allows malformed path strings to reference files outside the intended directory. An attacker can use the vulnerable parameter to read arbitrary files on the server, exposing sensitive data such as configuration files, passwords, or server secrets. This weakness is categorized as CWE-35. The impact is limited to confidentiality loss; no memory corruption, injection, or code execution is described.

The issue affects the WordPress plugin "Printeers Print & Ship" from its earliest release through version 1.17.0. Any installation of the plugin up to and including that version is susceptible to the directory traversal exploit.

The CVSS vector indicates a moderate severity score of 5.3. The EPSS score is listed as less than 1%, implying a very low probability of exploitation in the wild at present. The vulnerability is not present in the CISA KEV catalog. Based on the description the likely attack vector is remote, via a crafted request to the plugin’s public endpoint, allowing an attacker to inject path traversal sequences. Exploitation requires the plugin to be installed and exposed on a web server and does not require authentication.