The CS Framework plugin for WordPress contains an arbitrary file read vulnerability (CWE-73) in the get_widget_settings_json() function. Authenticated attackers with subscriber-level privileges or above can exploit this flaw to read arbitrary files on the server, potentially exposing sensitive data. The vulnerability affects all versions up to 6.9 inclusive. The CVSS 3.1 base score is 7.5, indicating high severity. No patch or vendor advisory detailing remediation is currently available.

Successful exploitation allows an authenticated user with minimal privileges (subscriber-level) to read arbitrary files on the server hosting the WordPress site. This can lead to disclosure of sensitive information such as configuration files, credentials, or other data stored on the server. There is no indication of impact on integrity or availability, only confidentiality is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to the get_widget_settings_json() function. Avoid exposing sensitive files on the server where possible.