The Ludwig You WPMasterToolKit plugin suffers from an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This flaw allows users with high privileges to access files outside the intended directory scope, potentially exposing sensitive data. The issue affects all versions up to 1.13.1. The vulnerability has a CVSS 3.1 base score of 4.9, with network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

An attacker with high privileges on the system can exploit this vulnerability to read arbitrary files outside the intended directory restrictions, potentially leading to unauthorized disclosure of sensitive information. There is no impact on system integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege access to trusted users only and monitor for suspicious file access patterns related to the plugin. Avoid exposing the plugin's functionality to untrusted users.