CVE-2025-15020 is a path traversal vulnerability (CWE-22) in the Gotham Block Extra Light WordPress plugin, affecting all versions up to 1.5.0. The flaw allows authenticated users with contributor or higher privileges to leverage the 'ghostban' shortcode to read arbitrary files on the server. This arbitrary file read can lead to exposure of sensitive data stored on the server. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with contributor-level or higher access can read arbitrary files on the server hosting the vulnerable plugin. This can lead to disclosure of sensitive information, potentially compromising confidentiality. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Gotham Block Extra Light plugin if possible to mitigate risk.