An improper limitation of pathname to a restricted directory vulnerability enables an attacker to request arbitrary files from the WordPress server through the Barcode Scanner with Inventory & Order Manager plugin. By manipulating file request parameters, the attacker can download files that should not be publicly accessible, potentially exposing sensitive configuration files, credentials, or other confidential data. This direct path traversal flaw can lead to confidentiality breaches.

The vulnerability affects all instances of the Barcode Scanner with Inventory & Order Manager plugin distributed by Dmitry V. (CEO of "UKR Solution") with versions from n/a through 1.9.0. Users deploying the plugin at or below this release threshold are at risk.

The CVSS base score of 4.9 reflects a moderate severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation as of the latest data. The issue is not currently listed in CISA’s KEV catalog, suggesting no known mass exploitation. Based on the description, the likely attack vector is remote via a web request to the plugin’s file download endpoint, allowing unauthenticated or role‑limited users to craft requests that traverse directory boundaries. The exploit requires minimal user interaction or advanced privileges, but since the plugin operates within the WordPress web interface, the attacker could execute the request from a remote location.