This vulnerability in VibeThemes WPLMS plugin allows path traversal via specially crafted '.../...//' sequences. It affects all versions before 1.9.9.5.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, and results in a scope change with no confidentiality impact but integrity and availability impacts. The vulnerability could allow an attacker to manipulate file paths to affect system integrity and availability.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to perform path traversal attacks. This can lead to integrity loss and denial of service or availability impact on the affected system. Confidentiality is not impacted according to the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and monitor for suspicious activity related to path traversal attempts. Avoid exposing the vulnerable plugin to untrusted networks or users with low privileges.