Task Manager, a WordPress plugin, contains a flaw in its callback_get_text_from_url() function that allows an authenticated user with Subscriber or higher permissions to supply a file path and retrieve the file’s contents. This local file inclusion vulnerability (CWE‑73) can expose sensitive configuration data, credentials, or other confidential information, compromising the confidentiality of the hosting environment without giving code execution rights.

The affected product is the Task Manager plugin by eoxia, distributed through WordPress. All releases up to and including version 3.0.2 are vulnerable; any WordPress site running those versions is at risk.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. Because an attacker must first authenticate, the practical risk depends on how widely Subscriber or higher role users can read server files. No evidence of widespread exploitation has been reported, and the flaw is not listed in CISA’s known‑exploited‑vulnerabilities catalog. Nonetheless, unpatched sites remain susceptible to secrets disclosure if the plugin remains at a vulnerable version.