The LUNA RADIO PLAYER plugin for WordPress contains a directory traversal vulnerability (CWE-22) in the js/fallback.php file. This flaw allows unauthenticated remote attackers to read arbitrary files on the server by manipulating the pathname, bypassing intended directory restrictions. The vulnerability affects all plugin versions up to and including 6.24.01.24. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

Successful exploitation enables an unauthenticated attacker to read arbitrary files on the web server hosting the vulnerable plugin. This can lead to disclosure of sensitive information such as configuration files, credentials, or other data stored on the server. There is no indication of integrity or availability impact. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the LUNA RADIO PLAYER plugin or restricting access to the js/fallback.php file to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.