The Yoco Payments plugin for WordPress contains a CWE-22 path traversal vulnerability affecting all versions up to 3.9.0. An unauthenticated attacker can exploit the file parameter to access arbitrary files on the server, potentially disclosing sensitive data. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. No patch or vendor advisory details are currently available to confirm remediation status.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server hosting the Yoco Payments plugin, potentially exposing sensitive information. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable plugin or disabling it if possible to prevent exploitation.