The Health Check & Troubleshooting plugin for WordPress contains a path traversal flaw where a carefully crafted input such as '.../...//' can cause the plugin to resolve file paths outside its intended directory. This weakness, classified as CWE-35, allows an attacker to read arbitrary files on the server that are readable by the web server user, such as configuration files or the WordPress database credentials. Unlike remote code execution, the damage is limited to confidentiality leakage of sensitive data and potential integrity impact if an attacker can access executable scripts or configuration files.

Vulnerable installations are those running WordPress.org Health Check & Troubleshooting plugin version 1.7.1 or earlier. No additional version granularity is supplied. Any WordPress site that has installed this plugin and has not applied the 1.7.2 fix is at risk.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The plugin is a web‑accessible component, so the likely attack vector is remote via crafted HTTP requests. The vulnerability is not listed in the CISA KEV catalog, indicating no widely reported exploitation yet, but administrators should still treat it as a potential threat to confidentiality.