A critical directory traversal vulnerability in the Yogeta WP Cloud WordPress plugin enables unauthenticated remote attackers to download sensitive server files.

The plugin fails to perform capability checks or validate file paths on a public-facing endpoint, which permits an unauthenticated attacker to supply arbitrary file paths to a read function. This flaw is classified as CWE-552, indicating that sensitive server files or directories are accessible to external parties.

The ability for an unauthenticated user to read arbitrary files poses a severe risk to organizational security, as it may lead to the exfiltration of sensitive configuration files, database credentials, or environment variables. With a CVSS score of 8.6, this vulnerability represents a high-severity risk that could facilitate full system compromise or unauthorized access to backend infrastructure.

Immediate Action: Since a specific patch version is currently unavailable, administrators must immediately deactivate and remove the Yogeta WP Cloud plugin from all WordPress installations.

Proactive Monitoring: Review server access logs for anomalous requests targeting sensitive file paths, such as wp-config.php or system-level configuration files, originating from unknown IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized access to non-public file types.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the ease of exploitation and the potential for total credential exposure, this vulnerability requires immediate attention. Security teams should prioritize the removal of the affected plugin until a vendor-verified fix is released and confirmed to be secure.