The vulnerability in RomanCode MapSVG occurs because the plugin does not correctly restrict file path access. This allows an attacker to construct a request that references files outside the intended directory, effectively reading or downloading any file on the server that the web process can access. The weakness is a classic Path Traversal flaw mapped to CWE-22 and results in unauthorized information disclosure.

Any WordPress installation that has the MapSVG plugin installed in a version earlier than 8.6.12 is vulnerable. This includes sites on any hosting environment where the plugin may be present, regardless of user role, because the flaw is triggered by a crafted HTTP request to the plugin’s file handling endpoint.

The CVSS score of 6.5 indicates a medium severity risk. The EPSS score of less than 1% suggests low current exploit probability, and the entry is not listed in the CISA KEV catalog. The attack path is likely remote, where an attacker submits a specially formed URL or form containing path traversal sequences; if successful, they can retrieve arbitrary files such as configuration files, user uploads, or even database dumps, depending on file system permissions. No additional prerequisites such as authentication are mentioned, implying that the flaw can be leveraged by unauthenticated users, making the threat significant for exposed sites.