The BFG Tools – Extension Zipper plugin for WordPress suffers from a CWE-22 path traversal vulnerability due to improper validation of the 'first_file' parameter in its zip() function. Authenticated attackers with Administrator privileges can exploit this to access files outside the /wp-content/plugins/ directory, potentially exposing sensitive configuration files. This affects all versions up to and including 1.0.7. The CVSS 3.1 base score is 4.9, reflecting a network attack vector, low attack complexity, high privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. No patch or remediation details are provided in the available data.

Successful exploitation allows an attacker with Administrator-level access to read arbitrary files on the server outside the plugin directory. This can lead to disclosure of sensitive information such as database credentials stored in wp-config.php. The vulnerability does not impact system integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator access to trusted users only and monitor for suspicious activity related to the plugin. Avoid using the vulnerable plugin version if possible.