The vulnerability is a path traversal flaw that allows a subscriber to request files outside the intended directory tree. If exploited, an attacker could read arbitrary files on the server, potentially exposing sensitive configuration data, credentials, or user content. The weakness is classified as CWE-35, which indicates that user-supplied input is insufficiently validated before being used in file path construction.

The issue affects the Do Lasso plugin for WordPress developed by Lasso Analytics, Inc., in all released versions up to and including 358. Users running this plugin on any WordPress installation are vulnerable.

The CVSS score of 7.5 indicates a high impact, with potential confidentiality and integrity loss but no direct code execution. The EPSS metric is not available, so it is unclear how often this flaw is actively exploited, though it is not currently listed in CISA's KEV catalog. The likely attack vector involves a subscriber-level request that harnesses the path traversal logic, as implied by the description. An authenticated or unauthenticated user who can trigger the vulnerable code path may be able to fetch files from arbitrary locations, contingent upon the hosting environment's file permissions.