The Zephyr Project Manager plugin for WordPress suffers from a CWE-22 directory traversal vulnerability in all versions up to 3.3.203. This vulnerability allows authenticated users with at least Custom-level privileges to manipulate the 'file' parameter to access arbitrary files on the server, potentially exposing sensitive information. Additionally, if PHP's 'allow_url_fopen' setting is enabled, the vulnerability can be leveraged to perform server-side request forgery (SSRF). The CVSS 3.1 base score is 4.9, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. There are no known exploits in the wild and no vendor-provided patch or advisory at this time.

An attacker with authenticated access at Custom-level or above can read arbitrary files on the server, potentially exposing sensitive data. On servers with 'allow_url_fopen' enabled, the attacker may also perform SSRF attacks, which could lead to further internal network reconnaissance or exploitation. There is no direct impact on integrity or availability reported. The vulnerability is rated medium severity with a CVSS score of 4.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin to trusted users only and consider disabling or limiting the 'file' parameter usage if possible. Additionally, disabling 'allow_url_fopen' in PHP configurations can mitigate the SSRF risk. Monitor for vendor updates to apply any forthcoming patches promptly.