The attacker has an unknown plaintext byte P, and due to the way CBC mode works (together with the timing attack), is able to test if (P xor X) is a valid paddi

The attacker has an unknown plaintext byte P, and due to the way CBC mode works (together with the timing attack), is able to test if (P xor X) is a valid padding byte with X chosen by the attacker. Once the attacker finds an X that makes a valid padding byte, she can trivially determine P.