CVE-2026-2351 is an Arbitrary File Read vulnerability in the eoxia Task Manager WordPress plugin affecting all versions up to 3.0.2. The issue arises from improper handling of file paths in the callback_get_text_from_url() function, allowing authenticated users with low privileges (Subscriber and above) to read arbitrary files on the server. This can lead to disclosure of sensitive data stored in those files. The vulnerability is tracked under CWE-73 and has a CVSS 3.1 score of 6.5, reflecting a medium impact on confidentiality without affecting integrity or availability.

An attacker with at least Subscriber-level access to the WordPress site can exploit this vulnerability to read arbitrary files on the server. This may result in exposure of sensitive information such as configuration files, credentials, or other private data. The vulnerability does not impact system integrity or availability according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to file access. Avoid exposing sensitive files on the server where possible. Follow updates from the vendor eoxia for any released patches or official mitigations.