The DELUCKS DELUCKS SEO plugin suffers from an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This allows an attacker with low privileges to potentially read files outside the intended directory scope. The affected versions include all versions up to 2.7.0. The vulnerability is network exploitable without user interaction and impacts confidentiality but not integrity or availability, as reflected in the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No official patch or remediation guidance is currently provided.

An attacker with low privileges can exploit this vulnerability to access sensitive files outside the intended directory, potentially leading to unauthorized disclosure of confidential information. There is no indication of impact on data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and monitor for unusual file access patterns. Avoid granting unnecessary privileges to users who can interact with the plugin.