The Propovoice: All-in-One Client Management System plugin for WordPress contains an arbitrary file read vulnerability in the send_email() function in versions up to 1.7.6.7. This vulnerability allows unauthenticated remote attackers to specify arbitrary file paths, leading to disclosure of file contents on the server. The issue is categorized as CWE-73, indicating external control over file name or path. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, no privileges required, and high confidentiality impact. No patch or official fix has been documented yet.

Successful exploitation of this vulnerability enables unauthenticated attackers to read arbitrary files on the affected server, which may include sensitive configuration files, credentials, or other confidential data. This can lead to information disclosure that compromises the security posture of the affected system. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin's functionality or disabling it if possible. Monitor for vendor updates regarding patches or mitigations. Avoid exposing the affected plugin to untrusted networks or users.