The vulnerability allows a local file inclusion flaw in the e2pdf WordPress plugin to be exploited without authentication, enabling an attacker to read arbitrary files on the server that the web application process can access. This type of weakness can compromise confidentiality and can serve as a foothold for further attacks if sensitive configuration or credential files are accessed. It is identified as a CWE-98 weakness.

The issue affects the e2pdf plugin for WordPress, with all versions up to and including 1.32.40 being vulnerable. The file inclusion flaw exists in the code paths that resolve file paths from user input without adequate validation, thereby permitting inclusion of local files beyond the intended directory. Only versions newer than 1.32.43 contain the fix, where the input validation has been hardened.

The CVSS score of 8.1 classifies it as high severity, indicating that successful exploitation could cause significant damage if the attacker can read critical files. The EPSS score is not available, suggesting that there is no current data on exploitation frequency, but the lack of KEV listing implies no confirmed large-scale exploits yet. The likely attack vector is unauthenticated local file inclusion, where an input parameter is tricked into pointing to an arbitrary file on the server, bypassing normal application safeguards.