The vulnerability resides in the WP Responsive Images WordPress plugin and allows an unauthenticated attacker to provide a crafted 'src' parameter that triggers a Path Traversal flaw (CWE‑22). This flaw enables reading the contents of arbitrary files on the hosting server, potentially exposing sensitive information such as configuration files, credentials, or source code. The impact is a confidentiality breach; there is no direct evidence of code execution, denial of service, or other secondary effects in the provided data.

The affected product is the WP Responsive Images plugin developed by Stuart Bates. All released versions up to and including 1.0 are vulnerable. Users running WordPress with this plugin installed on any version of the plugin in the 1.0 series are impacted.

The CVSS score is 7.5, reflecting a high severity for confidentiality loss. The EPSS score of 28% indicates a relatively high probability of exploitation in practice. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending a web request containing an arbitrary 'src' value, and no authentication is required. The exploit path is straightforward via standard HTTP request manipulation.