The Plugin Inspector plugin contains a path traversal vulnerability that allows attackers to download arbitrary files from the server. This flaw permits confidential files such as wp-config.php and database credentials to be retrieved via the plugin’s download endpoint. The vulnerability is classified as CWE-22 and has a CVSS score of 4.9, indicating moderate impact on confidentiality.

The flaw affects installations of gioni’s Plugin Inspector plugin version 1.5 and earlier. All users who have not upgraded past version 1.5 are potentially vulnerable. No other vendors or products are listed in the CNA data.

The CVSS score of 4.9 indicates a moderate risk, while the EPSS score of less than 1% suggests very low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, so no known active exploitation campaigns are reported. The most likely attack vector is via a remote request to the plugin’s file download endpoint, though this is inferred from the description as the precise attack path is not detailed.