FastDup plugin for WordPress contains a path traversal vulnerability in the 'dir_path' REST endpoint. The flaw allows an authenticated user with Contributor role or higher to influence directory traversal, enabling the reading of files from arbitrary directories on the server. This exposes sensitive configuration files, credentials, or private files, directly creating an information disclosure risk.

All FastDup installations up to and including version 2.7. The plugin is found under the ninjateam:FastDup – Fastest WordPress Migration & Duplicator product line, typically integrated in WordPress sites that rely on FastDup for migration.

The CVSS score of 6.5 classifies it as medium severity, while an EPSS score below 1% indicates a low probability of exploitation at the time of disclosure. The vulnerability is not listed in CISA's KEV catalog, further suggesting limited active exploitation. Because the path traversal requires authenticated access with Contributor privileges, the attacker must possess valid credentials; however, once authenticated, the API call can be used to read any file path that the server process can access, making the attack straightforward for compromised or poorly protected accounts.