The Spectra Gutenberg Blocks plugin for WordPress versions up to 2.12.6 contains a CWE-22 path traversal vulnerability in the get_block_default_attributes function. Authenticated users with contributor-level or higher permissions can exploit this flaw to read the contents of any attributes.php file on the server. This improper limitation of pathname input could lead to unauthorized disclosure of sensitive data stored in these files. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting low complexity and limited impact confined to confidentiality. No known exploits in the wild have been reported.

An attacker with contributor-level or higher permissions can read arbitrary attributes.php files on the server, potentially exposing sensitive configuration or attribute data. There is no indication of impact on integrity or availability. The confidentiality impact is limited but could aid further attacks if sensitive information is disclosed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level permissions to trusted users only and monitor for suspicious activity related to file access. Avoid exposing sensitive data in attributes.php files if possible.