This vulnerability in the labs64 PluginPass pluginpass-pro-plugintheme-licensing component involves improper limitation of a pathname to a restricted directory, enabling path traversal attacks. Specifically, an attacker can manipulate web input that is used in file system calls to access or affect files outside the intended directory scope. The affected versions include all versions up to and including 0.9.10. The CVSS v3.1 base score is 8.6, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact is on availability, with no confidentiality or integrity impact reported. No patch or mitigation details are currently available.

The vulnerability can be exploited remotely without authentication or user interaction to manipulate file system calls via path traversal, potentially causing denial of service or other availability impacts. There is no reported impact on confidentiality or integrity. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigation steps are provided in the available data.