This vulnerability (CWE-22) in DynamicWebLab WordPress Team Manager allows improper limitation of a pathname to a restricted directory, leading to PHP Local File Inclusion. The flaw exists in versions up to 2.1.12 and can be exploited remotely with low privileges and no user interaction. The vulnerability could allow an attacker to read sensitive files on the server, impacting confidentiality without affecting integrity or availability. No official fix or patch has been published yet, and the vendor has not provided remediation details.

An attacker with low privileges can exploit this path traversal vulnerability to include local files via PHP, potentially exposing sensitive information on the server. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin and limiting user privileges to trusted users only. Monitor for updates from DynamicWebLab regarding patches or mitigations.