This vulnerability (CWE-22) in Samuel Marshall JCH Optimize versions up to 4.2.0 involves improper limitation of a pathname to a restricted directory, commonly known as path traversal. The flaw allows an attacker with network access and low privileges to access files outside the intended directory scope, potentially exposing sensitive information. The CVSS 3.1 base score is 4.3, reflecting low complexity and no user interaction required, but limited impact confined to confidentiality. No official remediation or patch is currently documented.

The vulnerability could allow an attacker with low privileges to read files outside the intended directory structure, potentially leading to limited confidentiality loss. There is no impact on integrity or availability reported. No known active exploitation in the wild has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected plugin and consider limiting permissions to reduce exposure. Monitor for vendor updates and apply patches promptly once available.