The Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin versions up to 3.6.7 contain a path traversal vulnerability identified as CVE-2024-47324. This vulnerability involves the improper handling of the '.../...//' sequence, which can be used to traverse directories outside the intended scope. The CVSS 3.1 base score is 7.5, with network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. No patch or official remediation information is currently available.

Successful exploitation of this vulnerability could allow an attacker with low privileges to read, modify, or delete files outside the plugin's intended directory, potentially leading to full compromise of the affected WordPress installation's confidentiality, integrity, and availability. The high CVSS score reflects the serious nature of these impacts. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin or disabling it if possible. Monitor vendor channels for updates and apply patches promptly once available.