The nickboss Iptanus File Upload plugin for WordPress suffers from a CWE-22 improper limitation of a pathname to a restricted directory vulnerability. Specifically, the 'uploadpath' parameter in the wordpress_file_upload shortcode does not properly restrict directory traversal, enabling authenticated users with Contributor-level privileges or above to upload files to arbitrary server locations. This could lead to limited unauthorized file placement on the web server. The vulnerability affects all versions up to and including 4.24.7 and has a CVSS 3.1 base score of 4.3 (medium severity). No patch or official remediation information is currently available.

An authenticated attacker with Contributor-level or higher access can exploit this vulnerability to upload files to arbitrary locations on the web server. This could potentially allow limited unauthorized modification or placement of files, which may facilitate further attacks or persistence. There is no direct impact on confidentiality or availability reported, and no known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious file uploads related to the wordpress_file_upload shortcode. Avoid using the vulnerable plugin version if possible or consider disabling the file upload functionality as a temporary mitigation.