The Lumise plugin for WordPress is vulnerable to a directory traversal flaw in the process_checkout function, allowing an attacker to construct a payload that reads the contents of any file on the server. Attackers can supply a specially crafted design.stages[*].image parameter in the cart JSON upload, causing the plugin to process the path and expose file data. This flaw enables unauthenticated disclosure of sensitive files, such as configuration files or credentials, which can compromise the confidentiality and integrity of the entire WordPress installation.

The vulnerability affects the King-Theme Product Designer for WooCommerce WordPress—Lumise plugin, all versions up to and including 2.1.2. Any site that has installed this plugin without upgrading to a newer version is at risk.

The CVSS score of 7.5 indicates a high severity for information disclosure. Although no EPSS data is available, the exploit requires no prior authentication; any user can retrieve a nonce via the /?lumise=ajax action=init handler and then invoke the vulnerable /?lumise=cart endpoint with a crafted path. The vulnerability is not listed in the CISA KEV catalog, but its remote, unauthenticated nature and the ability to read arbitrary files make it a significant risk if exploited.