The InfusedWoo Pro plugin for WordPress contains a flaw that allows an attacker without authentication to read any file the web server can access through the popup_submit endpoint. The plugin accepts a file path or URL parameter that is not properly validated, enabling a direct read of arbitrary files on the server (CWE‑918). This deficiency can expose configuration files, credentials, or other sensitive data and potentially allow the attacker to understand or manipulate internal services.

All WordPress sites that have Infused Addons – InfusedWoo Pro installed with a version of 5.1.2 or earlier are affected. Versions newer than 5.1.2 are not listed as vulnerable.

The CVSS score of 7.5 indicates high severity; the EPSS score is not available and the vulnerability is not listed on the CISA KEV catalog, suggesting no confirmed exploits yet. The likely attack vector is a straightforward HTTP request to the popup_submit action carrying a crafted file path parameter. No authentication or additional conditions are required beyond the presence of the vulnerable plugin, so the impact is broad and the exploitation cost low.