The 简数采集器 plugin for WordPress contains an arbitrary file read vulnerability (CWE-73) in all versions up to and including 2.6.3. The flaw exists in the __kds_flag functionality that handles importing featured images, allowing authenticated attackers with Administrator or higher privileges to read arbitrary files on the server. This could lead to disclosure of sensitive data. The CVSS 3.1 base score is 4.9 (medium), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or remediation information is currently provided.

An attacker with Administrator-level access can exploit this vulnerability to read arbitrary files on the server hosting the WordPress plugin. This can lead to exposure of sensitive information stored in those files, potentially compromising confidentiality. There is no impact on system integrity or availability. The vulnerability requires high privileges, limiting exploitation to trusted users with elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the __kds_flag functionality. Avoid using the affected plugin versions if possible or consider disabling the plugin temporarily.