EIP-2026-114034

This is a writeup describing a local file disclosure vulnerability in the WordPress Plugin Service Finder Booking before version 3.2. The vulnerability allows unauthenticated users to disclose server files via a GET parameter in downloads.php.