The WPIDE – File Manager & Code Editor plugin for WordPress suffers from a Full Path Disclosure vulnerability (CWE-200) in all versions up to 3.4.9. This arises because the plugin uses the PHP-Parser library that outputs results from parser rebuild commands, exposing the full path of the web application to unauthenticated users. While the disclosed information alone is not sufficient to cause damage, it can facilitate further attacks if other vulnerabilities exist on the affected site. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting its limited impact and ease of exploitation without authentication.

The vulnerability exposes the full filesystem path of the web application to unauthenticated attackers. This information disclosure is classified as a confidentiality impact with no direct impact on integrity or availability. The disclosed path information by itself is not harmful but can assist attackers in crafting more targeted attacks if other vulnerabilities are present. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor for updates from xplodedthemes. Until a fix is available, consider restricting access to the plugin or disabling it if not required, to reduce exposure. No vendor advisory states that no action is required or that the issue is already mitigated.