The WordPress File Upload plugin (Iptanus File Upload) contains a CWE-22 path traversal vulnerability in the wfu_file_downloader.php component. This flaw permits unauthenticated remote attackers to bypass directory restrictions and access arbitrary files on the server. The vulnerability affects all plugin versions up to and including 4.24.13. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact.

Successful exploitation allows attackers to read sensitive files outside the intended upload directory, potentially exposing confidential information stored on the server. There is no impact on integrity or availability reported. The vulnerability does not require authentication, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, consider restricting access to the vulnerable script or implementing web application firewall rules to block malicious path traversal attempts targeting wfu_file_downloader.php.