Out of its folder,into your settings.
Your server holds more than your web pages. This flaw lets a stranger ask for files that were never meant to be shown, such as the settings file with your database password.
What it is
Some parts of a site hand out files by name: a download, a picture, a template. The software should only ever give out files from its own folder. With this flaw it does not check, so a request can wander out of that folder and into the rest of the server.
What could happen to your site
The prize is usually the settings file. On a WordPress site it holds the database password and the secret keys that keep people signed in. With those, a stranger can get to everything in the database, or sign in as anyone.
A few flaws of this kind delete files rather than read them, which can take a site offline or, in some cases, make it reinstall itself under a stranger's control.
How likely it is
Found from time to time in plugins that handle downloads, uploads or backups, and in some server software. One that needs no login is serious, because the files it can reach are the keys to the rest of the site.
How it gets fixed
Update to the fixed version. If the flaw could have been used, change the database password and the site's secret keys afterwards, as they may already have been read.
What to ask your developer
Send whoever looks after your site this:
Ask your developer“The Mendbird report says some of our software has a flaw that could let someone read files on the server. Can you update it, and change the database password and secret keys to be safe?”