Client Portal (Pro) <= 5.6.2 - Authenticated (CP Client+) Arbitrary File Download
mediumThe Client Portal Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.6.2. This makes it possible for authenticated attackers, with Custom-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- CVSS:
- 6.5
- Affected:
- up to 5.6.2
- Fixed in:
- 5.6.3
- Disclosed:
- Apr 16, 2026