This vulnerability is a directory traversal flaw in the Bogdan Bendziukov Squeeze WordPress plugin. Improper handling of path sequences such as ".../...//" allows an attacker to read arbitrary files from the server filesystem, potentially exposing sensitive configuration, credential, or other confidential data. The weakness is classified as CWE-35, which focuses on incorrect path handling leading to unauthorized file disclosure.

The Squeeze plugin, versions from any initial release up to and including 1.7.7, is affected. No other products or versions are listed. The vendor is Bogdan Bendziukov, and the product name is Squeeze.

The CVSS score for this vulnerability is 5, indicating moderate severity, and the EPSS score is lower than 1%, suggesting a low current probability of exploitation. This issue is not in the CISA KEV catalog. Based on the nature of the flaw, it is inferred that a remote attacker could trigger the vulnerability by submitting crafted path requests through the plugin’s interface, which is typical for web‑based directory traversal vulnerabilities. Given the moderate CVSS, low EPSS, and lack of KEV listing, the overall risk is considered low to moderate, but file disclosure still warrants attention.