The UnderConstructionPage PRO plugin for WordPress allows authenticated users with Subscriber-level access to read arbitrary files on the server by supplying arbitrary local paths in the template_thumbnail parameter. The plugin then copies the requested file into a publicly accessible uploads directory, exposing the file contents to anyone who can download that upload. This flaw is an Arbitrary File Read vulnerability classified as CWE‑22 and can lead to the disclosure of confidential data such as configuration files, credentials, or code.

All installations of the Under Construction Page (Pro) component from WebFactory that are version 5.76 or earlier are affected. Users running older versions are exposed until they upgrade to a patched release. The vulnerability does not affect versions 5.77 and later.

The CVSS score is 6.5, indicating moderate severity, while the EPSS score of less than 1% suggests the current likelihood of exploitation is low. However, the flaw only requires a logged‑in Subscriber account, which is commonly available on many WordPress sites, creating a broad attack surface. No publicly known exploits are documented and the vulnerability is not listed in the CISA KEV catalog. The most probable attack vector involves an authenticated user issuing a template_thumbnail request with an arbitrary file path, causing the plugin to copy the file into the uploads directory where it can later be retrieved.