The Yogeta WP Cloud plugin, through version 1.0, fails to validate a user-supplied file path before passing it to a file‑read function on a publicly accessible endpoint that has no authorization checks. This flaw allows any Internet user to craft a request containing a file path and retrieve the contents of that file from the server. Sensitive files, such as configuration files containing credentials, can be exposed, leading to information disclosure and potential compromise of privileged accounts.

All installations of the Yogeta WP Cloud WordPress plugin with a version of 1.0 or earlier are vulnerable. No specific patch version is identified in the advisory, but any upgrade beyond 1.0 removes the described flaw.

The vulnerability can be exploited remotely over the network without authentication, using a crafted URL pointing to a desired file. The CMS does not enforce any access controls on the endpoint, so an attacker can trigger the file download from any location. Because no CVSS score is supplied and the EPSS score is unavailable, the exact severity is uncertain, but the impact is high due to unrestricted file access and potential credential theft. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild yet, yet the lack of authorization makes it a high‑risk asset in any environment that relies on the plugin.