The vulnerability is a path traversal flaw in the Aeroscroll Gallery plugin, allowing an attacker to craft URLs containing traversal characters. When processed, the plugin can read files from directories outside the intended web root. Based on the description, this could expose sensitive configuration files or other confidential data, potentially compromising site confidentiality. The possibility of further compromise is inferred, not explicitly stated in the CVE data.

The flaw affects all installations of the Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery plugin version 1.0.13 and earlier. The plugin was provided by yannisraft and is commonly used in WordPress websites.

The CVSS score of 7.5 indicates high severity, and the EPSS score of less than 1% suggests a low probability of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. Attackers may be able to exploit the flaw remotely by issuing HTTP requests to the vulnerable script without authentication; this inference is based on the description that the flaw allows directory traversal. This could enable reading arbitrary files outside the web root.