The bestwebsoft Error Log Viewer plugin allows a directory traversal flaw in the rrrlgvwr_get_file function. An attacker who can authenticate as an Administrator or higher can supply a path that resolves to any file on the server, reading its contents. This vulnerability, classified as CWE‑22, can expose sensitive configuration files, credentials, or private user data, leading to confidentiality compromise.

WordPress sites running the Error Log Viewer by BestWebSoft plugin version 1.1.6 or earlier are affected. The plugin is listed under the BestWebSoft vendor family and is included in any WordPress installation that has not upgraded beyond 1.1.6.

The CVSS score of 4.9 reflects a moderate severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The issue is not catalogued in CISA’s KEV. Exploitation requires the attacker to be authenticated with Administrator‑level privileges; from there, they can craft a request to trigger the vulnerable function and retrieve arbitrary files.