The vulnerability identified as CVE-2025-27283 involves improper limitation of a pathname to a restricted directory (path traversal) in the rockgod100 Theme File Duplicator plugin, versions up to 1.3. This flaw allows an attacker with low privileges to access files outside the designated directory, potentially exposing sensitive information. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with low privileges can exploit this vulnerability to read arbitrary files on the affected system outside the intended directory. This can lead to disclosure of sensitive information. There is no indication of impact on data integrity or system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and monitor for suspicious activity related to file access. Avoid granting unnecessary privileges to users who can interact with this plugin.