This vulnerability is a path‑traversal flaw located in the Frontend Admin by DynamiApps WordPress plugin. An attacker can supply crafted input that bypasses directory restrictions and obtain arbitrary files from the web server. The impact is potential disclosure of sensitive data, configuration files, or source code, which can aid further attacks. The weakness is a classic pathname traversal, identified as CWE‑22.

The affected product is the Frontend Admin by DynamiApps plugin for WordPress, versions up to and including 3.28.7. The plugin is developed by Shabti Kaplan. Any WordPress installation that has the plugin installed and enabled with a version <= 3.28.7 is vulnerable. No specific WordPress core version is mentioned.

The CVSS score of 6.8 indicates a moderate severity with potential for significant impact if exploited. The EPSS score of less than 1% suggests a low but non‑zero probability of exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to be remote via the plugin’s public download URL, as the flaw resides in a web‑exposed component. Attack prerequisites are minimal: the plugin must be present and the attacker must have access to the site’s public interface.