The critical vulnerability in this WordPress plugin isn't merely the directory traversal in the invoice generation function—it's the architectural chain that allows an authenticated subscriber to read arbitrary server files through a document generation endpoint that was designed for legitimate invoice retrieval. The get_image_src_in_base64 function accepts a path parameter, reads the file, base64-encodes it, embeds the result directly into cached HTML, and serves it back through the same invoice retrieval endpoint that authenticated the user. This creates a pipeline from traversal parameter to attacker-controlled output with no structural breakpoint.
What makes this severe is the privilege level: subscriber. The nonce plus access key authentication model was designed to prevent CSRF and ensure only the invoice owner could retrieve their document—but it provides zero defense against an authenticated attacker who simply uses the endpoint as intended while crafting a traversal payload. The system conflates 'I own this invoice' with 'I should be able to read arbitrary server files referenced by this invoice,' creating an authorization boundary violation, not an authentication failure.
The caching mechanism amplifies the severity significantly. The traversal output doesn't just get returned once—it persists in cached invoice HTML. More critically, the actual file read never appears in server logs because the cache serves the HTML directly, creating a detection void rather than a detection gap. An attacker can exfiltrate wp-config.php, other plugin source code, or anything the web server can read, and the logs show only a legitimate invoice download request.
Even after patching, the cached traversal output persists on disk or in object cache as a dormant payload—readable by anyone requesting that invoice template, regardless of whether they know about the original vulnerability. Patching without cache invalidation doesn't close the breach; it just stops adding to it.
For defenders: patch the traversal vector immediately, but also flush all cached invoice HTML objects, inspect cached files for base64-encoded content that shouldn't be there, and audit other document generation endpoints for similar patterns. The presentation context (invoice delivery) defeats traditional anomaly detection because attacker behavior looks identical to expected user behavior—focus detection on path patterns in parameters rather than request anomaly.