This vulnerability is a Path Traversal flaw (CWE‑22) in the ionCube tester plus WordPress plugin. The CVE description states that the plugin improperly limits file pathnames to a restricted directory, allowing a path traversal vulnerability. Although the description does not explicitly say that the attacker can download arbitrary files, the plugin’s name and common usage imply that it serves downloadable content; therefore it is inferred that an attacker could exploit the path traversal to download any file from the server where the plugin is installed, potentially exposing confidential files.

The affected product is the WordPress plugin ionCube tester plus authored by Robert Seyfriedsberger. All versions up to and including 1.3 are vulnerable; versions newer than 1.3 are presumed fixed or not affected. No further version granularity is given.

The CVSS score of 7.5 indicates high severity, primarily affecting confidentiality. The EPSS score of 7% suggests a moderate probability of exploitation. The vulnerability is not listed in CISA KEV. Remote attackers with access to the WordPress site or the plugin’s file download endpoint could potentially leverage path traversal to retrieve arbitrary files. Given the nature of the flaw, it may also serve as a foothold for subsequent attacks.