The vulnerability CVE-2025-28955 involves improper limitation of a pathname to a restricted directory in the FWDesign Easy Video Player WordPress & WooCommerce plugin (versions up to 10.0). This path traversal flaw allows remote attackers to read files outside the intended directory scope, potentially exposing sensitive information. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality with no impact on integrity or availability. The vulnerability can be exploited over the network without privileges or user interaction.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive files on the affected system. There is no indication of impact on data integrity or availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are documented at this time.