The Birth Chart Compatibility WordPress plugin is vulnerable to Full Path Disclosure in all releases up to and including version 2.0. The flaw arises from insufficient protection against direct access to the plugin's index.php file, which triggers an error that reveals the server's absolute file path. This disclosure falls under information‑disclosure weaknesses (CWE-200) and can assist attackers in locating application files, but it does not in itself cause direct damage; an attacker would need a separate vulnerability to exploit further.

The affected product is the Birth Chart Compatibility plugin for WordPress, produced by mia4. Versions up to and including 2.0 are vulnerable. No later releases are known to contain the issue based on the current advisory.

With a CVSS score of 5.3, the risk is moderate. The EPSS score of 4% indicates a small but non‑negligible likelihood of exploitation in the wild, and the vulnerability is not currently catalogued in the CISA KEV list. Exploitation is straightforward: a remote, unauthenticated attacker can issue an HTTP request to the plugin's index.php path, causing the server to return an error page that leaks the full file system path. Because the disclosed path alone does not compromise confidentiality, integrity, or availability, the threat is primarily to support other attacks and should be mitigated promptly.