The vulnerability identified as CVE-2024-12850 affects the sminozzi WordPress plugin 'Database Backup and Table Integrity Check with Automated Scheduling' in all versions up to 2.32. It is a CWE-22 path traversal issue in the database_backup_ajax_download() function, which improperly restricts pathname access. Authenticated attackers with administrator privileges can exploit this flaw to read arbitrary files on the server, potentially exposing sensitive data. The CVSS 3.1 base score is 4.9, reflecting a medium severity with network attack vector, low attack complexity, and high privileges required. No known exploits in the wild or patch information are currently available.

An attacker with administrator-level access can leverage this vulnerability to read arbitrary files on the server hosting the WordPress plugin. This can lead to disclosure of sensitive information, such as configuration files or credentials. There is no indication of impact on integrity or availability. The medium CVSS score reflects the requirement for high privileges and the confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to file access via the plugin. Avoid exposing the plugin to untrusted administrators. Follow vendor channels for updates on patches or mitigations.