The Restrict File Access WordPress plugin is vulnerable to directory traversal through its output() function, allowing an attacker who is authenticated with a Subscriber account or higher to read any file on the server. This flaw can expose sensitive data such as configuration files or private user information, potentially compromising the confidentiality of site content and backend data. The weakness is formally classified as CWE-22.

All installations of the Restrict File Access plugin distributed by josxha, for WordPress sites, are affected when the plug‑in version is 1.1.2 or older. Users who have installed the 1.1.2 release or any earlier version of the plugin are susceptible regardless of other security hardening measures.

The CVSS score of 6.5 places this flaw in the medium severity range, and the EPSS score of 1% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation is publicly documented. Attackers must first authenticate to the WordPress site with at least Subscriber‑level privileges, which is the likely vector, and then exploit the traversal flaw to read arbitrary files. The impact is limited to information disclosure rather than full compromise, but the ability to obtain confidential files can still lead to significant damage.