The Propovoice All‑in‑One Client Management System plugin contains an arbitrary file read flaw in its send_email() function. This flaw arises from improper input validation and is classified as CWE‑73. An unauthenticated attacker can specify any file path when invoking the email API, allowing read access to arbitrary files on the server and potentially revealing sensitive data, thus compromising confidentiality of the entire WordPress site.

The vulnerability impacts the fassionstorage Propovoice plugin for WordPress. All releases up to and including version 1.7.6.7 are affected. No information is available about versions beyond 1.7.6.7.

Based on the description, it is inferred that the attack vector is sending unauthenticated HTTP requests to the plugin’s email API endpoint. The CVSS score of 7.5 marks the issue as high severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild at present, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the flaw by sending unauthenticated HTTP requests to the plugin’s email API endpoint, gaining full read access to arbitrary files on the server.