The UiCore Elements plugin for WordPress allows unauthenticated users to read arbitrary file contents due to a missing capability check in the prepare_template() function, exposing sensitive data. This flaw represents a CWE‑862 authorization failure and can lead to disclosure of critical files such as configuration or credential files, potentially enabling further compromise.

All releases of the UiCore Elements plugin up to and including version 1.3.0 from vendor uicore are affected. Any WordPress site installing the plugin can be impacted if it has not applied a newer version.

The vulnerability carries a CVSS score of 7.5, indicating high severity. However, the EPSS score of less than 1% suggests that overall exploitation is unlikely at present, and it is not listed in the CISA KEV catalog. The most probable attack vector is an unauthenticated HTTP request to the plugin’s prepare_template() endpoint, where the attacker supplies a crafted filename.