The Formidable Charts plugin contains a directory traversal flaw in the handling of the 'frm_graph' parameter. An unauthenticated attacker can manipulate this value to read any file in the WordPress server’s file system, exposing confidential data such as configuration files or credentials. This vulnerability is a classic example of CWE‑22, where improper validation of user input allows access to files outside the intended directory.

WordPress sites that have both Formidable Forms (Lite or Pro) and Formidable Charts active, with the plugin installed at or below version 2.0.1. The flaw requires that the wp‑content/uploads/frm‑charts/ directory exists, a condition normally satisfied after a chart image is generated.

The CVSS score of 7.5 categorizes this flaw as high severity. While no EPSS value is available, the lack of a KEV listing does not diminish the potential for exploitation. Attackers can simply target the vulnerable endpoint through crafted HTTP requests without needing authentication. If the attacker can determine the location or content of sensitive files, the impact could be data theft or further compromise of the hosting environment.