The Mamunur Rashid Classified Listing WordPress plugin contains a path traversal flaw (CWE‑22) that allows an attacker to retrieve arbitrary files from the web server through the plugin’s download endpoint. This flaw can expose configuration files, user data, or other sensitive content located outside the intended directory, thereby compromising confidentiality and integrity. The advisory rates the issue as a medium severity vulnerability, reflected in its CVSS score of 6.5, and does not indicate an availability impact.

This vulnerability affects all releases of the plugin from its initial unversioned build up to and including version 5.3.8. The affected product is the Mamunur Rashid Classified Listing WordPress plugin, a third‑party extension that adds classified‑listing functionality to WordPress sites. No additional vendor or product information is listed beyond the plugin itself.

An attacker can exploit the flaw by delivering specially crafted HTTP requests containing directory traversal sequences to the download URL. Based on the description, it is inferred that authentication is not required, so the path traversal is likely exploitable by unauthenticated users through normal web traffic. The EPSS score is not available, making the exact exploitation likelihood uncertain; however, the medium CVSS rating suggests a meaningful threat level. The vulnerability is not listed in CISA’s KEV catalog.