The Photo Gallery by 10Web plugin for WordPress suffers from a CWE-35 path traversal vulnerability in the esc_dir function, present in all versions up to 1.8.23. This flaw enables authenticated attackers with administrator privileges to read arbitrary files and delete arbitrary directories, including the root WordPress directory. In the premium plugin version, administrators can delegate gallery edit permissions to lower-privileged users, potentially expanding the exploitability to contributors. The vulnerability has a CVSS 3.1 base score of 6.8, indicating medium severity. There is no indication of a patch or official fix at this time, and no known active exploitation has been reported.

Successful exploitation allows authenticated users with sufficient privileges to read sensitive files on the server and delete critical directories, including the WordPress root directory. This can lead to information disclosure and denial of service by disrupting the website's availability. The risk extends to lower-privileged users in the premium version if permissions are granted, increasing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative and gallery edit permissions to trusted users only. Monitor for updates from 10Web regarding patches or mitigations. Avoid granting gallery edit permissions to lower-privileged users in the premium version to reduce risk.