The Backuply WordPress plugin versions up to 1.2.3 contain a path traversal vulnerability (CWE-22) exploitable through the node_id parameter in the backuply_get_jstree function. This flaw permits users with administrator or higher privileges to read arbitrary files on the server, potentially exposing sensitive data. The vulnerability is network exploitable with low attack complexity and requires high privileges but no user interaction. The CVSS 3.1 base score is 6.5, reflecting a medium severity impact primarily on confidentiality and integrity.

An attacker with administrator or higher privileges can exploit this vulnerability to read arbitrary files on the server hosting the WordPress plugin. This can lead to disclosure of sensitive information, which may compromise the confidentiality and integrity of the system. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to file access. Avoid exposing sensitive files on the server and consider disabling or removing the plugin if not essential.