The AA-Team Pro Bulk Watermark Plugin for WordPress versions up to 2.0 is affected by a path traversal vulnerability identified as CVE-2025-28973. This vulnerability arises from improper input validation allowing the use of the path sequence '.../...//' to traverse directories. An attacker with low privileges can exploit this to read files outside the plugin's intended scope. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No patch or official remediation information is currently available.

Successful exploitation could allow an attacker with low privileges to read sensitive files on the server that are outside the intended directory of the plugin, potentially exposing confidential information. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access permissions to the plugin files and directories to limit exposure. Monitor vendor channels for updates and apply patches promptly once available.