The Otter Blocks WordPress plugin contains a CWE-22 path traversal vulnerability in its get_image function, present in all versions up to and including 3.0.6. This flaw allows unauthenticated attackers to retrieve arbitrary image files from the server by manipulating file path inputs. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or vendor advisory is currently available to confirm remediation status.

An unauthenticated attacker can exploit this vulnerability to view arbitrary image files on the affected server. These images may contain sensitive information, leading to potential information disclosure. There is no indication of impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin or disabling it if feasible to prevent exploitation. Monitor for updates from themeisle regarding patches or mitigations.