The Spice Blocks plugin for WordPress contains an improper restriction on pathname usage, enabling path traversal through an arbitrary file download mechanism. An attacker can supply a specially crafted request that causes the plugin to access files outside of the intended directory, potentially exposing configuration files, credentials, or other sensitive data. This weakness results in confidentiality leakage rather than code execution or denial of service.

All installations of Spice Blocks version 2.0.7.4 or earlier, as distributed by spicethemes, are affected. No other versions are mentioned in the advisory.

The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1% suggests that the exploit probability is currently low. This vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote exploitation via the plugin’s file download endpoint, possibly without requiring authentication; however, the description does not explicitly state authentication prerequisites, so this is inferred from the nature of the flaw.