A path traversal flaw exists in the Barcode Scanner with Inventory & Order Manager WordPress plugin that allows an attacker to navigate beyond intended directory boundaries. By manipulating URL parameters, malicious input can lead to reading sensitive files, consistent with CWE‑35.

The vulnerability affects the Barcode Scanner with Inventory & Order Manager plugin for WordPress, distributed by Dmitry V. (CEO of "UKR Solution"). All released versions up to and including 1.10.4 are susceptible, meaning any WordPress site running these versions is at risk.

The CVSS score of 7.2 classifies this issue as high severity, while the very low EPSS score (< 1 %) and absence from the KEV catalog indicate exploitation is unlikely at present. Nonetheless, the flaw can be triggered remotely via crafted web requests, potentially exposing confidential files if the server misconfigures file handling.