The Social Web Suite – Social Media Auto Post, Social Media Auto Publish WordPress plugin versions up to 4.1.11 contain a CWE-22 path traversal vulnerability in the download_log function. This flaw allows unauthenticated remote attackers to read arbitrary files on the server by manipulating file path inputs, bypassing intended directory restrictions. The vulnerability is publicly documented with a CVSS 3.1 base score of 7.5, indicating high severity due to network attack vector, no privileges required, no user interaction, and high confidentiality impact. No patch or official fix has been referenced in the available data.

Successful exploitation enables unauthenticated attackers to read arbitrary files on the affected server, which may include sensitive information such as configuration files, credentials, or other private data. This confidentiality breach does not affect integrity or availability directly. The high CVSS score reflects the ease of exploitation and potential data exposure risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's download_log functionality if possible, and monitor for updates from the vendor. Avoid exposing the affected plugin on publicly accessible servers without additional protective controls.