The vulnerability identified as CVE-2025-23819 in Marco Milesi WP Cloud allows improper limitation of a pathname to a restricted directory, resulting in an absolute path traversal issue. This flaw affects WP Cloud versions up to 1.4.3 and enables an unauthenticated attacker to access files outside the intended directory scope. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the affected system that should be restricted, potentially leading to information disclosure. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the affected service and applying compensating controls to limit exposure may be advisable.