CVE-2025-15487 is a path traversal vulnerability in the Code Explorer WordPress plugin (versions up to 1.4.6) that allows authenticated administrators to read arbitrary server files via manipulation of the 'file' parameter. This improper limitation of pathname access (CWE-22) can expose sensitive information stored on the server. The vulnerability has a CVSS 3.1 base score of 4.9 (medium severity) with network attack vector, low attack complexity, and high privileges required. No patch or vendor advisory is currently available, and the product is not a cloud service.

An attacker with Administrator-level access can exploit this vulnerability to read arbitrary files on the server, potentially exposing sensitive information. There is no indication of impact on integrity or availability, and no known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit Administrator-level access to trusted users only and monitor for suspicious activity related to file access within the plugin. Avoid exposing sensitive files on the server that could be read if exploited.