The vulnerability is an improper limitation of a pathname to a restricted directory. An attacker can construct a path that traverses outside the intended directory to retrieve any file the web server can read, leading to a breach of confidentiality and the possibility of further exploitation. This weakness is a classic path‑traversal flaw.

The affected product is the WordPress Upload Files Anywhere plugin from vanquish, versions from the earliest release up through 2.8. Any site running the plugin in that version range is vulnerable.

The CVSS score of 7.5 indicates a moderate‑to‑high severity vulnerability, and the EPSS score of <1% suggests a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The flaw is a classic path‑traversal vulnerability that could allow an attacker to retrieve files outside the intended directory. The likely attack vector is via the plugin’s publicly accessible download endpoint, based on the description that the vulnerability arises in the plugin’s download handling. The official description does not specify authentication requirements, so it is inferred that the exploit operates without authentication if the endpoint is publicly reachable, or may require a user with sufficient privileges if access is restricted.