CVE-2025-14867 is a path traversal vulnerability in the liangshao Flashcard Plugin for WordPress affecting all versions up to 0.9. The flaw is triggered via the 'source' attribute of the 'flashcard' shortcode, enabling authenticated users with contributor or higher privileges to read arbitrary server files. This improper limitation of pathname access could expose sensitive information stored on the server. The vulnerability has a CVSS score of 6.5, reflecting a medium impact primarily on confidentiality. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

An attacker with contributor-level or higher access to the WordPress site can exploit this vulnerability to read arbitrary files on the server. This could lead to disclosure of sensitive information, potentially compromising site security or user data confidentiality. There is no indication of impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access carefully and monitor for suspicious activity. Avoid using the vulnerable versions of the Flashcard plugin if possible.