Technical impact
The User Access Manager plugin for WordPress permits unauthenticated users to read arbitrary files on the server by exploiting a directory traversal flaw in the 'uamgetfile' parameter. When the attachment URL conversion fails, the plugin mistakenly streams a file from a path supplied by the attacker, bypassing the normal access check. This vulnerability can lead to disclosure of sensitive server files, configuration data, or private user information and is categorized as CWE-22.
Affected Systems
All instances of the User Access Manager plugin released by gm_alex, specifically versions 2.3.15 and earlier. Administrators should verify the installed version and upgrade if possible.
Risk and Exploitability
With a CVSS score of 7.5 the flaw is considered high severity, though the EPSS score is less than 1%, indicating a low probability of current exploitation. The lack of a CISA KEV listing further suggests limited known exploitation. However, because the attack vector is a simple HTTP request containing the 'uamgetfile' parameter, any website running a vulnerable plugin can be read by an attacker without authentication, making the risk significant for sites that store confidential data.
