The InfiniteWP Client plugin for WordPress contains a path traversal vulnerability (CWE-22) in all versions up to and including 1.13.0. This vulnerability is exploitable through the 'historyID' parameter in the ~/debug-chart/index.php endpoint, enabling unauthenticated attackers to read .txt files outside the restricted directory. The vulnerability does not require privileges or user interaction and impacts confidentiality but not integrity or availability. The CVSS 3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

An unauthenticated attacker can exploit this vulnerability to read arbitrary .txt files on the server outside the intended directory, potentially exposing sensitive information. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected endpoint or implementing web application firewall rules to block malicious path traversal attempts targeting the 'historyID' parameter.