The Malcure Malware Shield plugin for WordPress contains a missing capability check in its wpmr_inspect_file() function. This flaw allows any authenticated user who holds at least subscriber-level permissions to request the contents of any file located on the server through the plugin’s interface. The vulnerability can expose sensitive configuration files, credentials, or other confidential data, compromising the confidentiality of the site and potentially the integrity of the host environment.

Any WordPress site that has the Malcure Malware Shield plugin installed at version 16.8 or earlier is vulnerable. The issue exists across all WordPress core versions and does not depend on site configuration beyond the presence of the affected plugin.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not currently listed in the CISA KEV catalog. Attackers need only authenticated subscriber or higher privileges, which are common in logged‑in users, to trigger the file read. Once the attacker can supply an arbitrary file path via the vulnerable function, the plugin returns the file contents, potentially leaking sensitive information.