The WP Ultimate Exporter plugin for WordPress, versions up to 2.9, suffers from an absolute path traversal vulnerability (CVE-2025-24611). This flaw allows an attacker with high privileges to bypass directory restrictions and access arbitrary files on the server by manipulating file path inputs. The vulnerability is classified with a CVSS 3.1 base score of 4.9 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No patch or vendor advisory detailing remediation is currently available.

An attacker with high privileges on the affected system can exploit this vulnerability to read arbitrary files outside the intended directory scope, potentially exposing sensitive information. The vulnerability does not affect system integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege user access and monitor for suspicious file access patterns related to the plugin. Avoid exposing the plugin to untrusted users with elevated privileges.