What is the CVSS score of CVE-2026-40724?

CVE-2026-40724 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Client Portal Pro CVE-2026-40724

Q: Which versions of Client Portal Pro are affected by CVE-2026-40724?

Arbitrary file download via path traversal in the Client Portal (Pro) WordPress plugin versions 5.6.2 and earlier exposes sensitive server-side files to authenticated low-privilege users.

EUVD-2026-37593 MEDIUM

Path Traversal (CWE-22)

2026-06-17 Patchstack

WordPress Path Traversal Wordpress Plugin Client Portal Pro

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:L reflects required authenticated portal account; C:H for arbitrary file read; I:N and A:N as only read access is demonstrated with no write or denial capability.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:53 vuln.today

DescriptionCVE.org

CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions.

AnalysisAI

Arbitrary file download via path traversal in the Client Portal (Pro) WordPress plugin versions 5.6.2 and earlier exposes sensitive server-side files to authenticated low-privilege users. The CWE-22 flaw allows any registered portal user to craft a file request that escapes the intended directory boundary and retrieve arbitrary files accessible to the web server process - including wp-config.php containing database credentials. No public exploit or CISA KEV listing exists at time of analysis, but the high confidentiality impact combined with low attack complexity makes this a meaningful data exposure risk on affected WordPress installations.

Technical ContextAI

The vulnerability is a classic path traversal flaw (CWE-22) in the Client Portal (Pro) WordPress plugin developed by Client Portal Ltd. (CPE: cpe:2.3:a:client_portal_ltd.:client_portal_(pro):*:*:*:*:*:*:*:*). Path traversal vulnerabilities occur when user-supplied filename or path parameters containing sequences such as '../' are passed to file system operations without proper sanitization, canonicalization, or boundary enforcement. In WordPress plugin contexts, this commonly affects download or export endpoints that serve portal documents. Because WordPress installations typically store database credentials and configuration secrets in wp-config.php at the web root, a traversal flaw in any plugin with file-serving capability creates a high-value credential theft vector. The CVSS S:U (scope unchanged) indicates the traversal is constrained to files readable by the web server process, not an OS-level privilege escalation.

RemediationAI

Update the Client Portal (Pro) plugin to a version beyond 5.6.2 per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/leco-client-portal/vulnerability/wordpress-client-portal-pro-plugin-5-6-2-arbitrary-file-download-vulnerability. No exact patched version number is confirmed in the available data - consult the Patchstack advisory and the WordPress plugin repository directly to identify the specific fixed release before upgrading. As a compensating control pending patching, restrict access to the plugin's file download or document retrieval endpoints using a WAF rule that blocks path traversal sequences (e.g., '../', '%2e%2e%2f') in request parameters - note this may cause false positives if legitimate filenames contain dots. Additionally, move wp-config.php one directory above the WordPress web root (a supported WordPress hardening technique) to prevent its exposure even if traversal succeeds, and enforce least-privilege filesystem permissions so the web server process user cannot read files outside the intended document store.