The ABC Notation plugin for WordPress contains a path traversal vulnerability (CWE-22) in the handling of the 'file' attribute within the 'abcjs' shortcode. This flaw allows authenticated users with at least Contributor privileges to read arbitrary files on the server by manipulating the pathname, potentially exposing sensitive data. The vulnerability affects all plugin versions up to and including 6.1.3. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Successful exploitation allows an authenticated attacker with Contributor-level access or higher to read arbitrary files on the server hosting the WordPress site. This can lead to disclosure of sensitive information stored on the server. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for unusual activity related to the 'abcjs' shortcode usage. Avoid exposing sensitive files in locations accessible via the plugin's file attribute.