The WP Chill Htaccess File Editor plugin versions up to 1.0.19 contain a vulnerability where improper access control allows an attacker to insert sensitive information into files or directories that are externally accessible. This issue arises from misconfigured security controls that fail to restrict access appropriately, potentially exposing sensitive data to unauthorized parties. The vulnerability is identified as CVE-2025-22773 and was published on January 15, 2025. No official patch or fix has been documented, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

The vulnerability can lead to unauthorized exposure of sensitive information by allowing insertion into files or directories that are accessible externally. This could compromise confidentiality of data managed by the plugin. No known exploits have been reported, so active exploitation is not confirmed at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should review and tighten access control configurations for the Htaccess File Editor plugin to prevent unauthorized file or directory access. Monitoring for vendor updates is recommended.