The CubeWP Framework plugin for WordPress contains a directory traversal vulnerability in its cubewp_get_svg_content function. An attacker can supply crafted input that causes the plugin to read any file located on the server, including configuration files and credentials. The vulnerability is exploitable without authentication because a public nonce is emitted into page markup where the CubeWP posts shortcode or widget is rendered with AJAX loading enabled, allowing any visitor to obtain the necessary token before making the AJAX request. This flaw permits an unauthenticated user to gain confidential information from the web server, leading to information disclosure and potential compromise of the site.

WordPress sites running CubeWP Framework version 1.1.30 or earlier are affected. The manipulation is performed via the CubeWP framework’s AJAX endpoints that expose the vulnerable function, making the vulnerability present in all WordPress installations that include this plugin at or below the specified version.

The CVSS score of 7.5 indicates the potential for significant impact. The EPSS score of less than 1% suggests that while the flaw exists, widespread exploitation is unlikely at the moment. The vulnerability is not listed in the CISA KEV catalog, further indicating a lower current threat level. The attack vector is purely web‑based; any unauthenticated visitor who can load a page with the CubeWP shortcode or widget can obtain the nonce and send a crafted AJAX request to read files.