Path Traversal exists in the miniOrange Prevent files / folders access WordPress plugin. The flaw allows attackers to deliver crafted input that causes the plugin to resolve file paths outside its intended directory. By manipulating slashes and the '..' sequence, an attacker can read arbitrary files on the server, potentially exposing configuration data, credentials, or other sensitive information. This weakness is classified as CWE‑35 due to improper input validation and access control.

The vulnerability affects all installations of the miniOrange Prevent files / folders access plugin from its initial release through version 2.6.0. WordPress site administrators should check the installed plugin version and plan an upgrade if they are on a vulnerable release.

The CVSS score of 6.5 indicates a medium severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, an attacker could craft a URL containing repeated forward slashes or '..' sequences to traverse directories and read files outside the plugin’s intended directory. Successful exploitation would result in information disclosure but does not grant code execution.