The vulnerability CVE-2025-25163 affects the Zach Swetz Plugin A/B Image Optimizer up to version 3.3. It is caused by improper limitation of pathnames to restricted directories, enabling path traversal attacks. This allows an attacker to potentially read files outside the intended directory scope. The CVSS 3.1 base score is 7.5, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or remediation information is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to read sensitive files on the affected system outside the intended directories, potentially exposing confidential information. There is no reported impact on integrity or availability. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor for updates from the vendor and consider restricting access to the plugin or disabling it if feasible to reduce exposure.