The AR for WordPress plugin contains an unsanitized 'file' request parameter that enables directory traversal. This flaw, categorized as CWE‑22, allows an attacker to read arbitrary files on the server, potentially revealing sensitive data. Exploitation requires first retrieving a valid nonce through the publicly accessible ar_get_fresh_nonce AJAX handler and then reproducing the encryption key locally. Both actions are achievable without authentication on default free or unlicensed installations where ar_licence_key is unset, making the vulnerability practical for unauthenticated attackers.

The vulnerability affects the AR for WordPress plugin distributed by webandprint in all versions up to and including 8.40. WordPress sites using a default free or unlicensed installation and running these plugin versions are particularly susceptible, as the AJAX endpoints needed for nonce acquisition and key reproduction are publicly available until a licence key is configured.

The CVSS score of 7.5 positions this flaw in the high severity range. The EPSS score of <1 % indicates a low but nonzero likelihood of exploitation, and the CVE is not listed in the CISA KEV catalog. Because the attacker can obtain the necessary nonce and key with a single unauthenticated access request, the attack path is straightforward in environments that have not upgraded beyond version 8.40 or that lack a licence key, making this vulnerability realistic for many WordPress sites.