The WebFacing™ WordPress plugin versions 5.3 through 5.3.6 do not enforce authentication on the bundled assets/index.php script and do not validate the user‑supplied path before including it. An unauthenticated HTTP request can therefore supply an arbitrary file path, triggering a local file inclusion. The flaw permits an attacker to read any file readable by the web‑server process, potentially exposing configuration files, credentials, or server secrets.

WordPress sites that use the WebFacing™ plugin in versions 5.3 to 5.3.6 are affected. The vulnerability resides in the bundled assets/index.php script of the plugin.

The vulnerability is remotely exploitable via an HTTP request to the vulnerable script and requires no prior authentication. The CVSS score of 5.3 indicates moderate risk. The EPSS score of <1% suggests a low probability of exploitation. It is not listed in the CISA KEV catalog. Attackers with unrestricted web access can read arbitrary files on the server, potentially exposing sensitive data or creating a pivot point for further compromise.