The AR for WordPress plugin contains a directory traversal flaw triggered by an unsanitized 'file' request parameter. This weakness, rooted in CWE‑22, permits an including Exploitation requires the attacker to first obtain a valid nonce via the publicly accessible ar_get_fresh_nonce AJAX handler and then reproduce the encryption key locally. Both operations are achievable without authentication on default or unlicensed installations.

The flaw impacts the AR for WordPress plugin provided by vendor webandprint in all versions up to and including 8.40. WordPress sites running a default free or unlicensed installation where ar_licence_key is unset are especially vulnerable because they allow public access to the AJAX endpoints required for nonce acquisition and key reproduction.

The CVSS score of 7.5 indicates high severity. The EPSS score is < 1% and the CVE is not listed in CISA KEV catalog. Because the attacker can retrieve the nonce and locally reproduce the encryption key with a single unauthenticated access, the exploit is realistic for environments that have not upgraded beyond version 8.40.