The nickboss Iptanus File Upload plugin for WordPress contains a CWE-22 path traversal vulnerability in the wfu_file_downloader.php endpoint. This flaw allows unauthenticated remote attackers to bypass directory restrictions and read files outside the designated upload directory. The vulnerability affects all versions up to and including 4.24.13. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation enables an unauthenticated attacker to read arbitrary files on the server outside the intended directory, potentially exposing sensitive information. There is no impact on integrity or availability according to the CVSS vector. This can lead to confidentiality breaches but does not allow modification or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the wfu_file_downloader.php script via web server configuration or other access controls to prevent unauthenticated access. Monitor official vendor channels for updates and apply patches promptly once released.