The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy WordPress plugin (smub) contains a directory traversal vulnerability (CWE-73) in its file download functionality in all versions up to 3.3.2. This vulnerability allows authenticated attackers with Administrator-level access or higher to read arbitrary files on the server by manipulating file paths. The CVSS 3.1 base score is 4.9, reflecting a medium severity with network attack vector, low attack complexity, and high confidentiality impact but no integrity or availability impact. No patch or remediation guidance is currently available from the vendor.

An attacker with Administrator-level privileges can exploit this vulnerability to read arbitrary files on the server, potentially exposing sensitive information such as configuration files, credentials, or other private data. This compromises confidentiality but does not affect integrity or availability. Since exploitation requires high privileges, the risk is limited to scenarios where such access is already obtained or granted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to file downloads. Avoid exposing the plugin to untrusted administrators or users with elevated privileges.